theory CNode_DP

lemma seL4_CNode_Copy_sep:
  "\<lbrace>\<lambda>s. \<guillemotleft>root_tcb_id \<mapsto>f tcb \<and>*
         (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*
         cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
         (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
         (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>*
         (cnode_id, src_slot) \<mapsto>c src_cap \<and>*
         (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R\<guillemotright>
         s \<and>
        one_lvl_lookup cnode_cap 32 root_size \<and>
        one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and>
        one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and>
        unat src_depth \<le> word_bits \<and>
        0 < unat src_depth \<and>
        unat dest_depth \<le> word_bits \<and>
        0 < unat dest_depth \<and>
        is_tcb tcb \<and>
        is_cnode_cap cnode_cap \<and>
        is_cnode_cap cnode_cap' \<and>
        guard_equal cnode_cap src_index (unat src_depth) \<and>
        guard_equal cnode_cap' src_index (unat src_depth) \<and>
        guard_equal cnode_cap' dest_index (unat dest_depth) \<and>
        guard_equal cnode_cap src_root word_bits \<and>
        guard_equal cnode_cap dest_root word_bits \<and>
        src_index' = src_index \<and>
        cap_object cnode_cap = cnode_id \<and>
        cap_object cnode_cap' = cnode_id \<and>
        cnode_cap_slot = offset dest_root root_size \<and>
        cnode_cap_slot = offset src_root root_size \<and>
        src_slot = offset src_index root_size \<and>
        dest_slot = offset dest_index root_size \<and>
        cap_has_type src_cap \<and>
        \<not> is_untyped_cap src_cap\<rbrace>
   seL4_CNode_Copy dest_root dest_index dest_depth src_root src_index' src_depth UNIV
   \<lbrace>\<lambda>_. \<guillemotleft>root_tcb_id \<mapsto>f tcb \<and>*
         cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
         (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
         (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*
         (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>*
         (cnode_id, src_slot) \<mapsto>c src_cap \<and>*
         (cnode_id, dest_slot) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R\<guillemotright>\<rbrace>" apply (simp add:seL4_CNode_Copy_def sep_state_projection2_def) apply (rule do_kernel_op_pull_back) apply (rule hoare_name_pre_state) apply (simp add:is_tcb_def split:cdl_object.split_asm) apply (rule hoare_pre) apply (rule call_kernel_with_intent_allow_error_helper[where check=True,simplified,rotated -1]) apply assumption apply fastforce apply (clarsimp simp:sep_conj_assoc) apply (rule hoare_post_imp[OF _
              set_cap_wp]) apply (sep_select 4,assumption) apply wp[1] apply (rule_tac P = "root_tcb_id \<mapsto>f tcb \<and>*
              (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*
              cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
              (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
              (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>*
              (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>*
              (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R"
              in mark_tcb_intent_error_sep_inv) apply wp[1] apply (rule corrupt_ipc_buffer_sep_inv) apply (rule_tac P = "(\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap
           \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap''))
           (cap_object cnode_cap', offset src_index root_size)
           (cap_object cnode_cap', offset dest_index root_size)))"
           in hoare_gen_asmEx) apply (elim conjE exE) apply simp apply (rule false_e_explode) apply (rule no_exception_conj') apply (wp cnode_insert_cap_cdl_current_thread)[1] apply (rule no_exception_conj') apply wp[1] apply (rule hoare_post_impErr) apply (rule_tac R = "(root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* R" for R
             in invoke_cnode_insert_cap') apply simp apply (rule conjI[rotated]) apply (rule sep_any_imp_c'_conj[where cap = RestartCap]) apply (frule sep_map_c_asid_reset[where ptr = "(cnode_id, offset dest_index root_size)"
             ,OF reset_cap_asid_derived[OF update_cap_rights_reset_cap_asid]]) apply (erule cap_rights_reset_cap_asid) apply simp apply (sep_solve) apply sep_solve apply (assumption) apply (rule_tac Q = "\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id
                                    \<and> cdl_current_domain s = minBound) and
          < (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* Q> and
          K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode
          (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size)
          (cnode_id, offset dest_index root_size)))" for Q
          in hoare_strengthen_post[rotated]) apply (clarsimp simp:cap_of_insert_call_def) apply (rule conjI) apply (sep_select 2,assumption) apply (rule conjI) apply (drule reset_cap_asid_cap_type) apply (simp) apply (rule_tac x = cap'' in exI) apply (simp add:reset_cap_asid_derived) apply (wp set_cap_wp set_cap_all_scheduable_tcbs)[1] apply (rule_tac P = "(fst (c,ref)) = cnode_cap'
         \<and> get_index cs 0 = Some (cnode_cap',(cap_object cnode_cap',
          offset src_root root_size))" in hoare_gen_asmEx) apply (clarsimp simp: decode_invocation_simps split_def) apply (rule liftME_wp) apply wp apply (rule decode_cnode_copy_same_parent_rvu[where src_cap = src_cap and cap = cnode_cap']) apply (rule refl) apply simp apply fastforce apply clarsimp apply (rule_tac x = cap' in exI) apply fastforce apply (simp add:lookup_extra_caps_def Let_def
        mapME_def sequenceE_def get_index_def) apply (rule wp_no_exception_seq) apply wp[1] apply clarsimp apply (rule lookup_cap_and_slot_rvu[where r = root_size]) apply (rule hoare_pre) apply (rule lookup_cap_and_slot_rvu[where r = root_size]) defer apply (clarsimp simp:Let_def) apply (wp hoare_vcg_ball_lift sep_inv_to_all_scheduable_tcbs[OF update_thread_intent_update]
     hoare_vcg_imp_lift hoare_vcg_ex_lift hoare_vcg_all_lift is_cnode_cap_guard_equal
     update_thread_intent_update update_thread_cnode_at | clarsimp simp:Let_def)+ apply (intro conjI impI) apply sep_solve apply sep_solve apply (clarsimp simp:conj_comms) apply (thin_tac "(P \<and>* Q) (sep_state_projection sa)" for P Q) apply (rule conjI) apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def) apply (intro conjI,simp+) apply sep_solve apply (intro conjI impI ballI allI, simp_all) apply (frule reset_cap_asid_cnode_cap) apply clarsimp apply (simp add: cnode_cap_non_ep_related get_index_def)[1] apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def sep_conj_assoc) apply sep_solve apply (fastforce dest!: reset_cap_asid_cnode_cap)+ apply sep_solve apply (drule(1) reset_cap_asid_cnode_cap | simp)+ apply (clarsimp simp:sep_conj_assoc) apply sep_solve apply (clarsimp dest!:reset_cap_asid_cnode_cap) apply (clarsimp dest!:reset_cap_asid_cnode_cap) apply sep_solve done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. Separation_SD.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrace> seL4_CNode_Copy dest_root dest_index dest_depth src_root src_index' src_depth UNIV \<lbrace>\<lambda>_. Separation_SD.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index' src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index' src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType \<Longrightarrow> \<lbrace>(=) s\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index' src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 s x3\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace>
 2. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> ?Q66 s x3 sa proof (prove)
goal (14 subgoals):
 1. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; ?Pd2.69 s x3 sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op69 s x3) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr69 s x3 \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = ?intent_extra69 s x3
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?R69 s x3\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. ?R69 s x3\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra69 s x3\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 8. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV69 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb69 s x3 sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op69 s x3) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.69 s x3 sa\<rbrace>
 9. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV69 s x3 iv\<rbrace>
 10. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (?intent_op69 s x3) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror69 s x3 sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op69 s x3) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr69 s x3 \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = ?intent_extra69 s x3
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?R69 s x3\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. ?R69 s x3\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra69 s x3\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 7. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV69 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb69 s x3 sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op69 s x3) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace>
 8. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV69 s x3 iv\<rbrace>
 9. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (?intent_op69 s x3) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror69 s x3 sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 10. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id (?intent_extra69 s x3) \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?R69 s x3\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace>
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. ?R69 s x3\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra69 s x3\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 6. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV69 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb69 s x3 sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace>
 7. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV69 s x3 iv\<rbrace>
 8. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror69 s x3 sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 9. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 10. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s x3 type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?R69 s x3\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace>
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. ?R69 s x3\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra69 s x3\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 6. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV69 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb69 s x3 sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace>
 7. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV69 s x3 iv\<rbrace>
 8. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror69 s x3 sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 9. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 10. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s x3 type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* ?R165 s x3) sa\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) sa
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R165 s x3)\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra69 s x3\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 6. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV69 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb69 s x3 sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace>
 7. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV69 s x3 iv\<rbrace>
 8. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror69 s x3 sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 9. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 10. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ra69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>_. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace>
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Ra69 s x3\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 5. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV69 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb69 s x3 sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace>
 6. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV69 s x3 iv\<rbrace>
 7. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror69 s x3 sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 8. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 9. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Perror69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. ?Perror69 s x3\<rbrace>
 4. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV69 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb69 s x3 sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace>
 5. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV69 s x3 iv\<rbrace>
 6. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ sa. ?Perror69 s x3 sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 7. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 8. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> ?Perror69 s x3 sa\<rbrace>
 10. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Rb69 s x3\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)\<rbrace>
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R)\<rbrace>
 3. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV69 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb69 s x3 sa\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV69 s x3 iv\<rbrace>
 5. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R)\<rbrace>
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV69 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 3. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV69 s x3 iv\<rbrace>
 4. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?PIV69 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?PIV69 s x3 iv\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size))\<rbrakk> \<Longrightarrow> \<lbrace>?P'178 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P'178 s x3 iv and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; cnode_cap_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; cap_type src_cap \<noteq> Some UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'178 s x3 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P'178 s x3 iv and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'178 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = dest_root \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [src_root] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P'178 s x3 iv and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'178 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ _. False\<rbrace>
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P'178 s x3 iv and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'211 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)) \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id\<rbrace>, -
 2. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P213 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P213 s x3 iv and ?P'211 s x3 iv and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 4. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P213 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P213 s x3 iv and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'225 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound\<rbrace>, -
 2. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P227 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P227 s x3 iv and ?P'225 s x3 iv and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 4. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P227 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P227 s x3 iv and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P227 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace> invoke_cnode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)) \<lbrace>?Q236 s x3 iv cap'' type\<rbrace>, \<lbrace>?E236 s x3 iv cap'' type\<rbrace>
 2. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?Q236 s x3 iv cap'' type rv sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) sa
 3. \<And>s x3 iv cap'' type e sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?E236 s x3 iv cap'' type e sa\<rbrakk> \<Longrightarrow> False
 4. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. ?P227 s x3 iv and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 5. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s x3 iv cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size) = InsertCall (?cap241 s x3 iv cap'' type) (?src_slot241 s x3 iv cap'' type) (?dest_slot250 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size))))
 2. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift (?dest_slot250 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size))) \<mapsto>c ?cap241 s x3 iv cap'' type \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) sa
 3. \<And>s x3 iv cap'' type e sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?E247 s x3 iv cap'' type\<rbrakk> \<Longrightarrow> False
 4. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((?dest_slot250 s x3 iv) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 5. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) sa
 2. \<And>s x3 iv cap'' type e sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?E247 s x3 iv cap'' type\<rbrakk> \<Longrightarrow> False
 3. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 4. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) sa
 2. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 3. \<And>s x3 iv cap'' type e sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?E247 s x3 iv cap'' type\<rbrakk> \<Longrightarrow> False
 4. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 5. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) sa
 2. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 3. \<And>s x3 iv cap'' type e sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?E247 s x3 iv cap'' type\<rbrakk> \<Longrightarrow> False
 4. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 5. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (10 subgoals):
 1. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> ?rights262 s x3 iv cap'' type rv sa = ?rights'262 s x3 iv cap'' type rv sa
 2. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa; (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (?rights262 s x3 iv cap'' type rv sa) cap'') = (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (?rights'262 s x3 iv cap'' type rv sa) src_cap)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) sa
 3. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 4. \<And>s x3 iv cap'' type e sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?E247 s x3 iv cap'' type\<rbrakk> \<Longrightarrow> False
 5. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 6. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 7. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 8. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 10. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa; (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') = (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) sa
 2. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 3. \<And>s x3 iv cap'' type e sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?E247 s x3 iv cap'' type\<rbrakk> \<Longrightarrow> False
 4. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 5. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (9 subgoals):
 1. \<And>s x3 iv cap'' type sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa; (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') = (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R) sa
 2. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 3. \<And>s x3 iv cap'' type e sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?E247 s x3 iv cap'' type\<rbrakk> \<Longrightarrow> False
 4. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra248 s x3 iv) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 5. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 9. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s x3 iv cap'' type rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s x3 iv cap'' type e sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?E247 s x3 iv cap'' type\<rbrakk> \<Longrightarrow> False
 3. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 4. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 iv cap'' type e sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cap_object cnode_cap = cnode_id; cap_object cnode_cap' = cnode_id; offset src_root root_size = offset dest_root root_size; cnode_cap_slot = offset dest_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; reset_cap_asid cap'' = reset_cap_asid src_cap; iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)); cap_type src_cap = Some type; ?E247 s x3 iv cap'' type\<rbrakk> \<Longrightarrow> False
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (6 subgoals):
 1. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>_. (\<lambda>a. cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))\<rbrace>
 2. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 6. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 iv rv sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; ((\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q318 s x3 iv) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))) sa\<rbrakk> \<Longrightarrow> ((\<lambda>a. cdl.lift ((cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset dest_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) a \<and> cap_type (cap_of_insert_call iv) \<noteq> Some UntypedType) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap', offset src_index root_size) (cap_object cnode_cap', offset dest_index root_size)))) sa
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q318 s x3 iv) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 sa cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; one_lvl_lookup cnode_cap 32 root_size; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap' (unat src_depth) root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q318 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap, offset src_index root_size) (cap_object cnode_cap, offset dest_index root_size)))) sa; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; reset_cap_asid cap'' = reset_cap_asid src_cap; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> cap_type cap'' \<noteq> Some UntypedType \<and> (\<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid src_cap \<and> derived_cap (update_cap_rights (cap_rights cap'') cap'') = derived_cap (update_cap_rights (cap_rights cap''a) cap''a))
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q318 s x3 iv) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s x3 sa cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; one_lvl_lookup cnode_cap 32 root_size; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap' (unat src_depth) root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q318 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap, offset src_index root_size) (cap_object cnode_cap, offset dest_index root_size)))) sa; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; reset_cap_asid cap'' = reset_cap_asid src_cap; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa
 2. \<And>s x3 sa cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; one_lvl_lookup cnode_cap 32 root_size; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap' (unat src_depth) root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q318 s x3 (InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap, offset src_index root_size) (cap_object cnode_cap, offset dest_index root_size)))) sa; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; reset_cap_asid cap'' = reset_cap_asid src_cap; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cap_type cap'' \<noteq> Some UntypedType \<and> (\<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid src_cap \<and> derived_cap (update_cap_rights (cap_rights cap'') cap'') = derived_cap (update_cap_rights (cap_rights cap''a) cap''a))
 3. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q318 s x3 iv) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace>
 4. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 sa cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; one_lvl_lookup cnode_cap 32 root_size; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap' (unat src_depth) root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; reset_cap_asid cap'' = reset_cap_asid src_cap; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cap_type cap'' \<noteq> Some UntypedType \<and> (\<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid src_cap \<and> derived_cap (update_cap_rights (cap_rights cap'') cap'') = derived_cap (update_cap_rights (cap_rights cap''a) cap''a))
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s x3 sa cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; one_lvl_lookup cnode_cap 32 root_size; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap' (unat src_depth) root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; reset_cap_asid cap'' = reset_cap_asid src_cap; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cap_type cap'' \<noteq> Some UntypedType
 2. \<And>s x3 sa cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; one_lvl_lookup cnode_cap 32 root_size; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap' (unat src_depth) root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; reset_cap_asid cap'' = reset_cap_asid src_cap; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid src_cap \<and> derived_cap (update_cap_rights (cap_rights cap'') cap'') = derived_cap (update_cap_rights (cap_rights cap''a) cap''a)
 3. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace>
 4. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s x3 sa cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; one_lvl_lookup cnode_cap 32 root_size; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap' (unat src_depth) root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cap_type cap'' = cap_type src_cap\<rbrakk> \<Longrightarrow> cap_type cap'' \<noteq> Some UntypedType
 2. \<And>s x3 sa cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; one_lvl_lookup cnode_cap 32 root_size; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap' (unat src_depth) root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; reset_cap_asid cap'' = reset_cap_asid src_cap; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid src_cap \<and> derived_cap (update_cap_rights (cap_rights cap'') cap'') = derived_cap (update_cap_rights (cap_rights cap''a) cap''a)
 3. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace>
 4. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 sa cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; one_lvl_lookup cnode_cap 32 root_size; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap' (unat src_depth) root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; reset_cap_asid cap'' = reset_cap_asid src_cap; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<exists>cap''a. reset_cap_asid cap''a = reset_cap_asid src_cap \<and> derived_cap (update_cap_rights (cap_rights cap'') cap'') = derived_cap (update_cap_rights (cap_rights cap''a) cap''a)
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (7 subgoals):
 1. \<And>s x3 sa cap'' type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread sa = Some root_tcb_id; one_lvl_lookup cnode_cap 32 root_size; cdl_current_domain sa = minBound; one_lvl_lookup cnode_cap' (unat src_depth) root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; reset_cap_asid cap'' = reset_cap_asid src_cap; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> reset_cap_asid cap'' = reset_cap_asid src_cap \<and> derived_cap (update_cap_rights (cap_rights cap'') cap'') = derived_cap (update_cap_rights (cap_rights cap'') cap'')
 2. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace>
 3. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (6 subgoals):
 1. \<And>s x3 iv. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Ps69 s x3 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound) and cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) and K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size)))\<rbrace>
 2. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>?Ps69 s x3\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 6. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd69 s x3 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) s \<and> K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size))) s\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd69 s x3 xa (fst uu_) (snd uu_)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>s x3 c ref cs. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; fst (c, ref) = cnode_cap' \<and> get_index cs 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size)\<rbrakk> \<Longrightarrow> \<lbrace>?P'385 s x3 c ref cs\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) s \<and> K (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cnode_id, offset src_index root_size) (cnode_id, offset dest_index root_size))) s\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'385 s x3 (fst uu_) (snd uu_) xa and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'385 s x3 cnode_cap' (a, b) cs\<rbrace> liftME InvokeCNode (decode_cnode_invocation cnode_cap' (a, b) cs (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) s \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> iv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap, offset src_index root_size) (cap_object cnode_cap, offset dest_index root_size)))\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'385 s x3 (fst uu_) (snd uu_) xa and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'385 s x3 cnode_cap' (a, b) cs\<rbrace> decode_cnode_invocation cnode_cap' (a, b) cs (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV) \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) s \<and> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> InvokeCNode r = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap, offset src_index root_size) (cap_object cnode_cap, offset dest_index root_size)))\<rbrace>, \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'385 s x3 (fst uu_) (snd uu_) xa and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P'466 s x3 a b cnode_cap' (a, b) cs\<rbrace> decode_cnode_invocation cnode_cap' (a, b) cs (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV) \<lbrace>\<lambda>rv s. \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> InvokeCNode rv = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap, offset src_index root_size) (cap_object cnode_cap, offset dest_index root_size))\<rbrace>, -
 2. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>x6. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) x6 \<and> ?P'466 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa x6) and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (8 subgoals):
 1. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV = CNodeCopyIntent (?dest_index501 s x3 a b cnode_cap' (a, b) cs) (?dest_depth491 s x3 a b cnode_cap' (a, b) cs) (?src_index504 s x3 a b cnode_cap' (a, b) cs) (?src_depth494 s x3 a b cnode_cap' (a, b) cs) (?rights472 s x3 a b cs type)
 2. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cap_object cnode_cap' = cap_object cnode_cap'
 3. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> get_index cs 0 = Some (cnode_cap', ?cap_ref472 s x3 a b cs type)
 4. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<forall>cap'. reset_cap_asid cap' = reset_cap_asid src_cap \<longrightarrow> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap' \<inter> ?rights472 s x3 a b cs type) cap')) (cap_object cnode_cap', offset (?src_index504 s x3 a b cnode_cap' (a, b) cs) (?sz499 s x3 a b cnode_cap' (a, b) cs)) (cap_object cnode_cap', offset (?dest_index501 s x3 a b cnode_cap' (a, b) cs) (?sz499 s x3 a b cnode_cap' (a, b) cs))) = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap, offset src_index root_size) (cap_object cnode_cap, offset dest_index root_size)))
 5. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>x6. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) x6 \<and> (K (one_lvl_lookup (fst uu_) (unat (?dest_depth514 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) (?sz513 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) (?dest_index512 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) (unat (?dest_depth511 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat (?src_depth510 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) (?sz509 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) (?src_index508 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) (unat (?src_depth507 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<and> is_cnode_cap (fst uu_)) and cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode (?sz506 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<and>* (cap_object (fst uu_), offset (?src_index504 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) (?sz503 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset (?dest_index501 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) (?sz499 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c NullCap \<and>* ?R497 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) and K (unat (?src_depth496 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<le> word_bits \<and> 0 < unat (?src_depth494 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> unat (?dest_depth493 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<le> word_bits \<and> 0 < unat (?dest_depth491 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa))) x6) and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 8. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s x3 a b. ?dest_depth514 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?dest_depth491 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz513 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?dest_index512 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?dest_index501 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?dest_depth511 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?dest_depth491 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?src_depth510 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?src_depth494 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz509 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?src_index508 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?src_index504 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?src_depth507 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?src_depth494 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz506 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz503 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?src_depth496 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?src_depth494 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?dest_depth493 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?dest_depth491 s x3 a b cnode_cap' (a, b) proof (prove)
goal (7 subgoals):
 1. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cap_object cnode_cap' = cap_object cnode_cap'
 2. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> get_index cs 0 = Some (cnode_cap', ?cap_ref472 s x3 a b cs type)
 3. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<forall>cap'. reset_cap_asid cap' = reset_cap_asid src_cap \<longrightarrow> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap' \<inter> UNIV) cap')) (cap_object cnode_cap', offset src_index (?sz499 s x3 a b cnode_cap' (a, b) cs)) (cap_object cnode_cap', offset dest_index (?sz499 s x3 a b cnode_cap' (a, b) cs))) = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap, offset src_index root_size) (cap_object cnode_cap, offset dest_index root_size)))
 4. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>x6. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) x6 \<and> (K (one_lvl_lookup (fst uu_) (unat dest_depth) (?sz513 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) (?sz509 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_)) and cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode (?sz506 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<and>* (cap_object (fst uu_), offset src_index (?sz503 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index (?sz499 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c NullCap \<and>* ?R497 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) and K (unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth)) x6) and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 7. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s x3 a b. ?sz513 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz509 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz506 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz503 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b) proof (prove)
goal (6 subgoals):
 1. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> get_index cs 0 = Some (cnode_cap', ?cap_ref472 s x3 a b cs type)
 2. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<forall>cap'. reset_cap_asid cap' = reset_cap_asid src_cap \<longrightarrow> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap' \<inter> UNIV) cap')) (cap_object cnode_cap', offset src_index (?sz499 s x3 a b cnode_cap' (a, b) cs)) (cap_object cnode_cap', offset dest_index (?sz499 s x3 a b cnode_cap' (a, b) cs))) = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap, offset src_index root_size) (cap_object cnode_cap, offset dest_index root_size)))
 3. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>x6. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) x6 \<and> (K (one_lvl_lookup (fst uu_) (unat dest_depth) (?sz513 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) (?sz509 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_)) and cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode (?sz506 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<and>* (cap_object (fst uu_), offset src_index (?sz503 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index (?sz499 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c NullCap \<and>* ?R497 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) and K (unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth)) x6) and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 6. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s x3 a b. ?sz513 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz509 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz506 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz503 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b) proof (prove)
goal (5 subgoals):
 1. \<And>s x3 a b cs type. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<forall>cap'. reset_cap_asid cap' = reset_cap_asid src_cap \<longrightarrow> (\<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap' \<inter> UNIV) cap')) (cap_object cnode_cap', offset src_index (?sz499 s x3 a b cnode_cap' (a, b) cs)) (cap_object cnode_cap', offset dest_index (?sz499 s x3 a b cnode_cap' (a, b) cs))) = InvokeCNode (InsertCall (derived_cap (update_cap_rights (cap_rights cap'') cap'')) (cap_object cnode_cap, offset src_index root_size) (cap_object cnode_cap, offset dest_index root_size)))
 2. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>x6. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) x6 \<and> (K (one_lvl_lookup (fst uu_) (unat dest_depth) (?sz513 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) (?sz509 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_)) and cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode (?sz506 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<and>* (cap_object (fst uu_), offset src_index (?sz503 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index (?sz499 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c NullCap \<and>* ?R497 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) and K (unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth)) x6) and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s x3 a b. ?sz513 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz509 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz506 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz503 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b) proof (prove)
goal (5 subgoals):
 1. \<And>s x3 a b cs type cap'. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; reset_cap_asid cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>cap''. reset_cap_asid cap'' = reset_cap_asid src_cap \<and> derived_cap (update_cap_rights (cap_rights cap') cap') = derived_cap (update_cap_rights (cap_rights cap'') cap'') \<and> offset src_index (?sz499 s x3 a b cnode_cap' (a, b) cs) = offset src_index root_size \<and> offset dest_index (?sz499 s x3 a b cnode_cap' (a, b) cs) = offset dest_index root_size
 2. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>x6. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) x6 \<and> (K (one_lvl_lookup (fst uu_) (unat dest_depth) (?sz513 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) (?sz509 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_)) and cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode (?sz506 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<and>* (cap_object (fst uu_), offset src_index (?sz503 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index (?sz499 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c NullCap \<and>* ?R497 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) and K (unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth)) x6) and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s x3 a b. ?sz513 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz509 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz506 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz503 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b) proof (prove)
goal (5 subgoals):
 1. \<And>s x3 a b cs type cap'. \<lbrakk>tcb = Tcb x3; get_index cs 0 = Some (cnode_cap', cap_object cnode_cap, offset src_root root_size); cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; reset_cap_asid cap' = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> reset_cap_asid cap' = reset_cap_asid src_cap \<and> derived_cap (update_cap_rights (cap_rights cap') cap') = derived_cap (update_cap_rights (cap_rights cap') cap') \<and> offset src_index (?sz499 s x3 a b cnode_cap' (a, b) cs) = offset src_index root_size \<and> offset dest_index (?sz499 s x3 a b cnode_cap' (a, b) cs) = offset dest_index root_size
 2. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>x6. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) x6 \<and> (K (one_lvl_lookup (fst uu_) (unat dest_depth) (?sz513 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) (?sz509 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_)) and cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode (?sz506 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<and>* (cap_object (fst uu_), offset src_index (?sz503 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index (?sz499 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa)) \<mapsto>c NullCap \<and>* ?R497 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) and K (unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth)) x6) and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s x3 a b. ?sz513 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz509 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz506 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b)
\<lambda>s x3 a b. ?sz503 s x3 a b cnode_cap' (a, b) \<equiv>\<^sup>? \<lambda>s x3 a b. ?sz499 s x3 a b cnode_cap' (a, b) proof (prove)
goal (4 subgoals):
 1. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>x6. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) x6 \<and> cdl_current_thread x6 = Some root_tcb_id \<and> cdl_current_domain x6 = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) x6 \<and> (K (one_lvl_lookup (fst uu_) (unat dest_depth) root_size \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) root_size \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_)) and cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst uu_), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R497 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) and K (unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth)) x6) and K (fst (fst uu_, snd uu_) = cnode_cap' \<and> get_index xa 0 = Some (cnode_cap', cap_object cnode_cap', offset src_root root_size))\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (4 subgoals):
 1. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id src_root;
returnOk [x]
odE \<lbrace>\<lambda>xa sa. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst uu_) (unat dest_depth) root_size \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) root_size \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_) \<and> cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst uu_), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R497 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) sa \<and> fst uu_ = cnode_cap' \<and> (if xa \<noteq> [] then Some (xa ! 0) else None) = Some (cnode_cap', cnode_id, offset src_root root_size)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>s x3 uu_ uua_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'536 s x3 uu_ uua_\<rbrace> returnOk [uua_] \<lbrace>\<lambda>xa sa. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst uu_) (unat dest_depth) root_size \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) root_size \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_) \<and> cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst uu_), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R497 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) xa) sa \<and> fst uu_ = cnode_cap' \<and> (if xa \<noteq> [] then Some (xa ! 0) else None) = Some (cnode_cap', cnode_id, offset src_root root_size)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 2. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_cap_and_slot root_tcb_id src_root \<lbrace>?P'536 s x3 uu_\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 5. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (4 subgoals):
 1. \<And>s x3 uu_. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 (fst uu_) (snd uu_)\<rbrace> lookup_cap_and_slot root_tcb_id src_root \<lbrace>\<lambda>uua_ a. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c - \<and>* ((cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) a \<and> one_lvl_lookup (fst uu_) (unat dest_depth) root_size \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) root_size \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_) \<and> cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst uu_), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R497 s x3 (fst (snd uu_)) (snd (snd uu_)) (fst uu_) (snd uu_) [uua_]) a \<and> fst uu_ = cnode_cap' \<and> (if [uua_] \<noteq> [] then Some ([uua_] ! 0) else None) = Some (cnode_cap', cnode_id, offset src_root root_size)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (4 subgoals):
 1. \<And>s x3 a aa b type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.69 s x3 a (aa, b)\<rbrace> lookup_cap_and_slot root_tcb_id src_root \<lbrace>\<lambda>uu_ c. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c a \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) c \<and> cdl_current_thread c = Some root_tcb_id \<and> cdl_current_domain c = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) c \<and> cdl_current_thread c = Some root_tcb_id \<and> cdl_current_domain c = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c a \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) c \<and> one_lvl_lookup a (unat dest_depth) root_size \<and> guard_equal a dest_index (unat dest_depth) \<and> is_cnode_cap a \<and> one_lvl_lookup a (unat src_depth) root_size \<and> guard_equal a src_index (unat src_depth) \<and> is_cnode_cap a \<and> cdl.lift (cap_object a \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object a, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object a, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R497 s x3 aa b a (aa, b) [uu_]) c \<and> a = cnode_cap' \<and> uu_ = (cnode_cap', cap_object cnode_cap, offset src_root root_size)\<rbrace>, \<lbrace>\<lambda>_ s. False\<rbrace>
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ?Pd1.69 s x3 (fst uu_) (snd uu_) sa \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (3 subgoals):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'595 s x3 (fst uu_) (snd uu_)) \<longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst uu_) (unat dest_depth) root_size \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) root_size \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_) \<and> cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst uu_), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 (fst uu_) (snd uu_) c) sa \<and> fst uu_ = cnode_cap' \<and> (c, cap_object (?cap592 s x3 (fst uu_) (snd uu_)), offset src_root root_size) = (cnode_cap', cap_object cnode_cap, offset src_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 (fst uu_) (snd uu_) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 (fst uu_) (snd uu_) src_root \<mapsto>u ?cap'587 s x3 (fst uu_) (snd uu_) \<and>* ?R585 s x3 (fst uu_) (snd uu_)) sa) \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 3. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)]
\<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) proof (prove)
goal (4 subgoals):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q596 s x3\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>uu_ sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'595 s x3 (fst uu_) (snd uu_)) \<longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst uu_ \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst uu_) (unat dest_depth) root_size \<and> guard_equal (fst uu_) dest_index (unat dest_depth) \<and> is_cnode_cap (fst uu_) \<and> one_lvl_lookup (fst uu_) (unat src_depth) root_size \<and> guard_equal (fst uu_) src_index (unat src_depth) \<and> is_cnode_cap (fst uu_) \<and> cdl.lift (cap_object (fst uu_) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst uu_), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst uu_), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 (fst uu_) (snd uu_) c) sa \<and> fst uu_ = cnode_cap' \<and> (c, cap_object (?cap592 s x3 (fst uu_) (snd uu_)), offset src_root root_size) = (cnode_cap', cap_object cnode_cap, offset src_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 (fst uu_) (snd uu_) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 (fst uu_) (snd uu_) src_root \<mapsto>u ?cap'587 s x3 (fst uu_) (snd uu_) \<and>* ?R585 s x3 (fst uu_) (snd uu_)) sa) \<and> \<not> ep_related_cap (fst uu_)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> ?Q596 s x3 sa
 3. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 4. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (3 subgoals):
 1. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat dest_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) dest_index (unat dest_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat src_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_index (unat src_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> cdl.lift (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) ca) sa \<and> fst (c, cap_object (?cap599 s x3), offset dest_root root_size) = cnode_cap' \<and> (ca, cap_object (?cap592 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))), offset src_root root_size) = (cnode_cap', cap_object cnode_cap, offset src_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_root \<mapsto>u ?cap'587 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* ?R585 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* \<box> (root_size, word_bits) : ?cap599 s x3 dest_root \<mapsto>u ?cap'599 s x3 \<and>* ?R599 s x3) sa
 2. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 3. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (3 subgoals):
 1. \<And>s x3. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
 3. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat dest_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) dest_index (unat dest_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat src_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_index (unat src_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> cdl.lift (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) ca) sa \<and> fst (c, cap_object (?cap599 s x3), offset dest_root root_size) = cnode_cap' \<and> (ca, cap_object (?cap592 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))), offset src_root root_size) = (cnode_cap', cap_object cnode_cap, offset src_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_root \<mapsto>u ?cap'587 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* ?R585 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* \<box> (root_size, word_bits) : ?cap599 s x3 dest_root \<mapsto>u ?cap'599 s x3 \<and>* ?R599 s x3) sa
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (3 subgoals):
 1. \<And>s x3 type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> \<lbrace>?P69 s x3\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrace>
 2. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeCopyIntent dest_index dest_depth src_index src_depth UNIV)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> ?P69 s x3 sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa
 3. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat dest_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) dest_index (unat dest_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat src_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_index (unat src_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> cdl.lift (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) ca) sa \<and> fst (c, cap_object (?cap599 s x3), offset dest_root root_size) = cnode_cap' \<and> (ca, cap_object (?cap592 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))), offset src_root root_size) = (cnode_cap', cap_object cnode_cap, offset src_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_root \<mapsto>u ?cap'587 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* ?R585 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* \<box> (root_size, word_bits) : ?cap599 s x3 dest_root \<mapsto>u ?cap'599 s x3 \<and>* ?R599 s x3) sa
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (2 subgoals):
 1. \<And>x3 sa type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 sa x3) \<and>* (\<lambda>s. True)) sa) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 sa x3) \<and>* (\<lambda>s. True)) sa
 2. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat dest_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) dest_index (unat dest_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat src_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_index (unat src_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> cdl.lift (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) ca) sa \<and> fst (c, cap_object (?cap599 s x3), offset dest_root root_size) = cnode_cap' \<and> (ca, cap_object (?cap592 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))), offset src_root root_size) = (cnode_cap', cap_object cnode_cap, offset src_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_root \<mapsto>u ?cap'587 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* ?R585 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* \<box> (root_size, word_bits) : ?cap599 s x3 dest_root \<mapsto>u ?cap'599 s x3 \<and>* ?R599 s x3) sa
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (3 subgoals):
 1. \<And>x3 sa type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 sa x3) \<and>* (\<lambda>s. True)) sa
 2. \<And>x3 sa type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 sa x3) \<and>* (\<lambda>s. True)) sa
 3. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb69 s x3) \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat dest_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) dest_index (unat dest_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat src_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_index (unat src_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> cdl.lift (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) ca) sa \<and> fst (c, cap_object (?cap599 s x3), offset dest_root root_size) = cnode_cap' \<and> (ca, cap_object (?cap592 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))), offset src_root root_size) = (cnode_cap', cap_object cnode_cap, offset src_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_root \<mapsto>u ?cap'587 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* ?R585 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* \<box> (root_size, word_bits) : ?cap599 s x3 dest_root \<mapsto>u ?cap'599 s x3 \<and>* ?R599 s x3) sa
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (2 subgoals):
 1. \<And>x3 sa type. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup cnode_cap' (unat dest_depth) root_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; src_index' = src_index; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index root_size; type \<noteq> UntypedType; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* (\<lambda>s. True)) sa
 2. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat dest_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) dest_index (unat dest_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat src_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_index (unat src_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> cdl.lift (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) ca) sa \<and> fst (c, cap_object (?cap599 s x3), offset dest_root root_size) = cnode_cap' \<and> (ca, cap_object (?cap592 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))), offset src_root root_size) = (cnode_cap', cap_object cnode_cap, offset src_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_root \<mapsto>u ?cap'587 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* ?R585 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* \<box> (root_size, word_bits) : ?cap599 s x3 dest_root \<mapsto>u ?cap'599 s x3 \<and>* ?R599 s x3) sa
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (1 subgoal):
 1. \<And>s x3 sa. \<lbrakk>tcb = Tcb x3; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (cnode_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup cnode_cap' (unat dest_depth) root_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap' dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> src_index' = src_index \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cnode_cap_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index root_size \<and> cap_has_type src_cap \<and> cap_type src_cap \<noteq> Some UntypedType; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* (\<lambda>s. True)) sa \<and> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cnode_id, offset src_index root_size) \<mapsto>c src_cap \<and>* (cnode_id, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c fst (c, cap_object (?cap599 s x3), offset dest_root root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat dest_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) dest_index (unat dest_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> one_lvl_lookup (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (unat src_depth) root_size \<and> guard_equal (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_index (unat src_depth) \<and> is_cnode_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and> cdl.lift (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)), offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) ca) sa \<and> fst (c, cap_object (?cap599 s x3), offset dest_root root_size) = cnode_cap' \<and> (ca, cap_object (?cap592 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))), offset src_root root_size) = (cnode_cap', cap_object cnode_cap, offset src_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) src_root \<mapsto>u ?cap'587 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size)) \<and>* ?R585 s x3 (fst (c, cap_object (?cap599 s x3), offset dest_root root_size)) (snd (c, cap_object (?cap599 s x3), offset dest_root root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap599 s x3), offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* \<box> (root_size, word_bits) : ?cap599 s x3 dest_root \<mapsto>u ?cap'599 s x3 \<and>* ?R599 s x3) sa
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (1 subgoal):
 1. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb x3 \<and>* (\<lambda>s. True)) sa; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* \<box> (root_size, word_bits) : ?cap599 s x3 dest_root \<mapsto>u ?cap'599 s x3 \<and>* ?R599 s x3) sa \<and> (\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> \<not> ep_related_cap c \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) src_root \<mapsto>u ?cap'587 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) \<and>* ?R585 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) sa \<and> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) \<longrightarrow> c = cnode_cap' \<and> ca = cnode_cap' \<and> is_cnode_cap c \<and> guard_equal c dest_index (unat dest_depth) \<and> guard_equal c src_index (unat src_depth) \<and> one_lvl_lookup c (unat dest_depth) root_size \<and> one_lvl_lookup c (unat src_depth) root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object (?cap592 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) = cap_object cnode_cap \<and> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa))
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (1 subgoal):
 1. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* \<box> (root_size, word_bits) : ?cap599 s x3 dest_root \<mapsto>u ?cap'599 s x3 \<and>* ?R599 s x3) sa \<and> (\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> \<not> ep_related_cap c \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) src_root \<mapsto>u ?cap'587 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) \<and>* ?R585 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) sa \<and> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) \<longrightarrow> c = cnode_cap' \<and> ca = cnode_cap' \<and> is_cnode_cap c \<and> guard_equal c dest_index (unat dest_depth) \<and> guard_equal c src_index (unat src_depth) \<and> one_lvl_lookup c (unat dest_depth) root_size \<and> one_lvl_lookup c (unat src_depth) root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object (?cap592 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) = cap_object cnode_cap \<and> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa))
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (2 subgoals):
 1. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* \<box> (root_size, word_bits) : ?cap599 s x3 dest_root \<mapsto>u ?cap'599 s x3 \<and>* ?R599 s x3) sa
 2. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> \<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> \<not> ep_related_cap c \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) src_root \<mapsto>u ?cap'587 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) \<and>* ?R585 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) sa \<and> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) \<longrightarrow> c = cnode_cap' \<and> ca = cnode_cap' \<and> is_cnode_cap c \<and> guard_equal c dest_index (unat dest_depth) \<and> guard_equal c src_index (unat src_depth) \<and> one_lvl_lookup c (unat dest_depth) root_size \<and> one_lvl_lookup c (unat src_depth) root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object (?cap592 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) = cap_object cnode_cap \<and> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa)
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (2 subgoals):
 1. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> one_lvl_lookup (?cap599 s x3) 32 root_size \<and> guard_equal (?cap599 s x3) dest_root 32 \<and> is_cnode_cap (?cap599 s x3) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap599 s x3 \<and>* (cap_object (?cap599 s x3) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (?cap599 s x3), offset src_root root_size) \<mapsto>c ?cap'599 s x3) \<and>* ?R599 s x3) sa
 2. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> \<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> \<not> ep_related_cap c \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) src_root \<mapsto>u ?cap'587 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) \<and>* ?R585 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) sa \<and> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) \<longrightarrow> c = cnode_cap' \<and> ca = cnode_cap' \<and> is_cnode_cap c \<and> guard_equal c dest_index (unat dest_depth) \<and> guard_equal c src_index (unat src_depth) \<and> one_lvl_lookup c (unat dest_depth) root_size \<and> one_lvl_lookup c (unat src_depth) root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object (?cap592 s x3 c (cap_object (?cap599 s x3), offset src_root root_size)) = cap_object cnode_cap \<and> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object (?cap599 s x3), offset src_root root_size) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa)
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (2 subgoals):
 1. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c ?cap'599 s x3) \<and>* ?R599 s x3) sa
 2. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> \<forall>c. reset_cap_asid c = reset_cap_asid (?cap'599 s x3) \<longrightarrow> \<not> ep_related_cap c \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 c (cap_object cnode_cap, offset src_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 c (cap_object cnode_cap, offset src_root root_size) src_root \<mapsto>u ?cap'587 s x3 c (cap_object cnode_cap, offset src_root root_size) \<and>* ?R585 s x3 c (cap_object cnode_cap, offset src_root root_size)) sa \<and> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size)) \<longrightarrow> c = cnode_cap' \<and> ca = cnode_cap' \<and> is_cnode_cap c \<and> guard_equal c dest_index (unat dest_depth) \<and> guard_equal c src_index (unat src_depth) \<and> one_lvl_lookup c (unat dest_depth) root_size \<and> one_lvl_lookup c (unat src_depth) root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object (?cap592 s x3 c (cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object cnode_cap, offset src_root root_size) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa)
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (1 subgoal):
 1. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> \<forall>c. reset_cap_asid c = reset_cap_asid cnode_cap' \<longrightarrow> \<not> ep_related_cap c \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap591 s x3 c (cap_object cnode_cap, offset src_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap589 s x3 c (cap_object cnode_cap, offset src_root root_size) src_root \<mapsto>u ?cap'587 s x3 c (cap_object cnode_cap, offset src_root root_size) \<and>* ?R585 s x3 c (cap_object cnode_cap, offset src_root root_size)) sa \<and> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size)) \<longrightarrow> c = cnode_cap' \<and> ca = cnode_cap' \<and> is_cnode_cap c \<and> guard_equal c dest_index (unat dest_depth) \<and> guard_equal c src_index (unat src_depth) \<and> one_lvl_lookup c (unat dest_depth) root_size \<and> one_lvl_lookup c (unat src_depth) root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object (?cap592 s x3 c (cap_object cnode_cap, offset src_root root_size)) = cap_object cnode_cap \<and> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object cnode_cap, offset src_root root_size) ca) sa \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa)
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object (?cap589 s x3 a (aa, b)), offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap592 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b)
\<lambda>s x3 a aa b. ?cap591 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap589 s x3 a (aa, b) proof (prove)
goal (13 subgoals):
 1. \<And>s x3 sa type c. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 2. \<And>s x3 sa type c. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u ?cap'587 s x3 c (cap_object cnode_cap, offset src_root root_size) \<and>* ?R585 s x3 c (cap_object cnode_cap, offset src_root root_size)) sa
 3. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> c = cnode_cap'
 4. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> ca = cnode_cap'
 5. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> is_cnode_cap c
 6. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> guard_equal c dest_index (unat dest_depth)
 7. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> guard_equal c src_index (unat src_depth)
 8. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) root_size
 9. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat src_depth) root_size
 10. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
A total of 13 subgoals...
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) proof (prove)
goal (14 subgoals):
 1. \<And>s x3 sa type c. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap cnode_cap'
 2. \<And>s x3 sa type c. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; c = cnode_cap'\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 3. \<And>s x3 sa type c. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u ?cap'587 s x3 c (cap_object cnode_cap, offset src_root root_size) \<and>* ?R585 s x3 c (cap_object cnode_cap, offset src_root root_size)) sa
 4. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> c = cnode_cap'
 5. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> ca = cnode_cap'
 6. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> is_cnode_cap c
 7. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> guard_equal c dest_index (unat dest_depth)
 8. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> guard_equal c src_index (unat src_depth)
 9. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) root_size
 10. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat src_depth) root_size
A total of 14 subgoals...
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) proof (prove)
goal (13 subgoals):
 1. \<And>s x3 sa type c. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; c = cnode_cap'\<rbrakk> \<Longrightarrow> \<not> ep_related_cap c
 2. \<And>s x3 sa type c. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u ?cap'587 s x3 c (cap_object cnode_cap, offset src_root root_size) \<and>* ?R585 s x3 c (cap_object cnode_cap, offset src_root root_size)) sa
 3. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> c = cnode_cap'
 4. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> ca = cnode_cap'
 5. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> is_cnode_cap c
 6. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> guard_equal c dest_index (unat dest_depth)
 7. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> guard_equal c src_index (unat src_depth)
 8. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) root_size
 9. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat src_depth) root_size
 10. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
A total of 13 subgoals...
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) proof (prove)
goal (12 subgoals):
 1. \<And>s x3 sa type c. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u ?cap'587 s x3 c (cap_object cnode_cap, offset src_root root_size) \<and>* ?R585 s x3 c (cap_object cnode_cap, offset src_root root_size)) sa
 2. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> c = cnode_cap'
 3. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> ca = cnode_cap'
 4. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> is_cnode_cap c
 5. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> guard_equal c dest_index (unat dest_depth)
 6. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> guard_equal c src_index (unat src_depth)
 7. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) root_size
 8. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat src_depth) root_size
 9. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 10. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object cnode_cap, offset src_root root_size) ca) sa
A total of 12 subgoals...
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) proof (prove)
goal (12 subgoals):
 1. \<And>s x3 sa type c. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> 32; unat src_depth \<le> 32; guard_equal cnode_cap dest_root 32; guard_equal cnode_cap src_root 32; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c ?cap'587 s x3 c (cap_object cnode_cap, offset src_root root_size) \<and>* ?R585 s x3 c (cap_object cnode_cap, offset src_root root_size)) sa
 2. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> c = cnode_cap'
 3. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> ca = cnode_cap'
 4. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> is_cnode_cap c
 5. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> guard_equal c dest_index (unat dest_depth)
 6. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> guard_equal c src_index (unat src_depth)
 7. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) root_size
 8. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat src_depth) root_size
 9. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 10. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid (?cap'595 s x3 c (cap_object cnode_cap, offset src_root root_size))\<rbrakk> \<Longrightarrow> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object cnode_cap, offset src_root root_size) ca) sa
A total of 12 subgoals...
flex-flex pairs:
\<lambda>s x3 a aa b. ?cap'595 s x3 a (aa, b) \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?cap'587 s x3 a (aa, b)
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) proof (prove)
goal (11 subgoals):
 1. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> c = cnode_cap'
 2. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> ca = cnode_cap'
 3. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap c
 4. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal c dest_index (unat dest_depth)
 5. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal c src_index (unat src_depth)
 6. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat dest_depth) root_size
 7. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup c (unat src_depth) root_size
 8. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 9. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object cnode_cap, offset src_root root_size) ca) sa
 10. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa
A total of 11 subgoals...
flex-flex pairs:
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) proof (prove)
goal (4 subgoals):
 1. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object cnode_cap, offset src_root root_size) ca) sa
 3. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa
 4. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa
flex-flex pairs:
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) proof (prove)
goal (3 subgoals):
 1. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift (cap_object c \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object c, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object c, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 c (cap_object cnode_cap, offset src_root root_size) ca) sa
 2. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa
 3. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa
flex-flex pairs:
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) proof (prove)
goal (3 subgoals):
 1. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; c = cnode_cap'; ca = cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 cnode_cap' (cap_object cnode_cap, offset src_root root_size) cnode_cap') sa
 2. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa
 3. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa
flex-flex pairs:
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) proof (prove)
goal (3 subgoals):
 1. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* ?R593 s x3 cnode_cap' (cap_object cnode_cap, offset src_root root_size) cnode_cap') sa
 2. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa
 3. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa
flex-flex pairs:
\<lambda>s x3 a aa b c. ?R594 s x3 a aa b (aa, b) [(c, cap_object cnode_cap, offset src_root root_size)] \<equiv>\<^sup>? \<lambda>s x3 a aa b. ?R593 s x3 a (aa, b) proof (prove)
goal (2 subgoals):
 1. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa
 2. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s x3 sa type c ca. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s; reset_cap_asid c = reset_cap_asid cnode_cap'; reset_cap_asid ca = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s x3 sa type. \<lbrakk>tcb = Tcb x3; src_index' = src_index; cdl_current_domain sa = minBound; cnode_id = cap_object cnode_cap; cdl_current_thread sa = Some root_tcb_id; cap_object cnode_cap' = cap_object cnode_cap; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) sa; 0 < unat dest_depth; 0 < unat src_depth; unat dest_depth \<le> word_bits; unat src_depth \<le> word_bits; guard_equal cnode_cap dest_root word_bits; guard_equal cnode_cap src_root word_bits; cnode_cap_slot = offset src_root root_size; offset dest_root root_size = offset src_root root_size; dest_slot = offset dest_index root_size; src_slot = offset src_index root_size; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap src_index (unat src_depth); guard_equal cnode_cap' dest_index (unat dest_depth); guard_equal cnode_cap' src_index (unat src_depth); one_lvl_lookup cnode_cap' (unat dest_depth) root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; type \<noteq> UntypedType; cap_type src_cap = Some type; one_lvl_lookup cnode_cap 32 root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c - \<and>* ((cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<longrightarrow>* root_tcb_id \<mapsto>f Tcb x3 \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset dest_index root_size) \<mapsto>c derived_cap (update_cap_rights (cap_rights src_cap) src_cap) \<and>* R)) sa proof (prove)
goal:
No subgoals!