theory CNode_DP

lemma seL4_CNode_Mutate_sep:
  "\<lbrace>\<lambda>s. \<guillemotleft>
     root_tcb_id \<mapsto>f tcb \<and>*
     (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>*

     \<comment> \<open>Root CNode.\<close>
     cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
     \<comment> \<open>Client cnode.\<close>
     dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>*

     \<comment> \<open>Cap to the root CNode.\<close>
     (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
     \<comment> \<open>Cap to the client CNode.\<close>
     (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>*
     \<comment> \<open>Cap that the root task has to its own CNode.\<close>
     (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>*
     \<comment> \<open>Cap to be copied, in the root CNode.\<close>
     (cnode_id, src_slot) \<mapsto>c src_cap \<and>*
     \<comment> \<open>Where to copy the cap (in the client CNode).\<close>
     (dest_id, dest_slot) \<mapsto>c NullCap \<and>*
      R\<guillemotright> s \<and>

     one_lvl_lookup cnode_cap 32 root_size \<and>
     one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and>
     one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and>

     \<comment> \<open>We need some word invariants\<close>
     unat src_depth \<le> word_bits \<and>
     0 < unat src_depth \<and>
     unat dest_depth \<le> word_bits \<and>
     0 < unat dest_depth \<and>

     is_tcb tcb \<and>
     is_cnode_cap dest_root_cap \<and>
     is_cnode_cap cnode_cap \<and>
     is_cnode_cap cnode_cap' \<and>
     guard_equal cnode_cap' src_index (unat src_depth) \<and>
     guard_equal cnode_cap src_index (unat src_depth) \<and>
     guard_equal dest_root_cap dest_index (unat dest_depth ) \<and>
     guard_equal cnode_cap src_root word_bits \<and>
     guard_equal cnode_cap dest_root word_bits \<and>
     \<comment> \<open>Caps point to the right objects.\<close>
     cap_object cnode_cap = cnode_id \<and>
     cap_object cnode_cap' = cnode_id \<and>
     cap_object dest_root_cap = dest_id \<and>

     \<comment> \<open>Cap slots match their cptrs.\<close>
     dest_root_slot = offset dest_root root_size \<and>
     cnode_cap_slot = offset src_root root_size \<and>
     src_slot = offset src_index root_size \<and>
     dest_slot = offset dest_index dest_size \<and>

     cap' = update_cap_data_det data src_cap \<and>
     valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap
   \<rbrace>
  seL4_CNode_Mutate dest_root dest_index dest_depth src_root src_index src_depth data
  \<lbrace>\<lambda>_. \<guillemotleft> root_tcb_id \<mapsto>f tcb \<and>*
       cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
       dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>*
       (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
       (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*
       (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>*
       (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>*
       (cnode_id, src_slot) \<mapsto>c NullCap \<and>*
       (dest_id, dest_slot) \<mapsto>c cap' \<and>* R\<guillemotright>\<rbrace>" apply (simp add:seL4_CNode_Mutate_def sep_state_projection2_def) apply (rule do_kernel_op_pull_back) apply (rule hoare_pre) apply (rule_tac
               intent_op = "CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)"
           and intent_cptr = dest_root
           and intent_extra = "[src_root]" in call_kernel_with_intent_no_fault_helper) apply (clarsimp simp:sep_conj_assoc) apply (rule hoare_post_imp[OF _
              set_cap_wp]) apply (sep_select 5,assumption) apply wp apply wp apply (rule_tac P = "\<exists>dcap.
           reset_cap_asid dcap = reset_cap_asid src_cap \<and>
           iv = InvokeCNode
           (MoveCall (update_cap_data_det data dcap)
           (cap_object cnode_cap', offset src_index root_size)
           (cap_object dest_root_cap, offset dest_index dest_size))"
           in hoare_gen_asmEx) apply clarsimp apply (rule false_e_explode) apply (rule no_exception_conj') apply (wp cnode_move_cap_cdl_current_thread)[1] apply (rule no_exception_conj') apply wp[1] apply (rule hoare_post_impErr) apply (rule_tac R = "(root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* R" for R
             in invoke_cnode_move_cap) apply clarsimp apply (rule conjI[rotated]) apply (rule sep_any_imp_c'_conj[where cap = RestartCap]) apply (subst(asm) sep_map_c_asid_reset[where cap' = " (update_cap_data_det data src_cap)"]) apply (simp add:reset_cap_asid_update_cap_data) apply (sep_solve) apply sep_solve apply (assumption) apply (rule_tac Q = "\<lambda>r. < (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* Q >
          and (\<lambda>a. cdl_current_thread a = Some root_tcb_id
                 \<and> cdl_current_domain a = minBound) and K(\<exists>dcap.
           reset_cap_asid dcap = reset_cap_asid src_cap \<and>
           iv = InvokeCNode
           (MoveCall (update_cap_data_det data dcap)
           (cap_object cnode_cap', offset src_index root_size)
           (cap_object dest_root_cap, offset dest_index dest_size)))" for Q
          in hoare_strengthen_post[rotated]) apply (clarsimp) apply (intro conjI) apply (sep_solve) apply fastforce apply (wp set_cap_wp set_cap_all_scheduable_tcbs) apply (rule_tac P = "is_cnode_cap c" in hoare_gen_asmEx) apply (simp add:decode_invocation_simps) apply (rule liftME_wp) apply (rule decode_cnode_mutate_rvu) apply (simp add:lookup_extra_caps_def Let_def mapME_def sequenceE_def get_index_def) apply (rule wp_no_exception_seq) apply wp apply (rule lookup_cap_and_slot_rvu[where r = root_size]) apply (rule lookup_cap_and_slot_rvu[where r = root_size]) apply (rule validE_validE_R) apply (rule hoare_pre) apply (rule lookup_cap_and_slot_rvu[where r = root_size]) apply (clarsimp simp:get_index_def) defer apply (wp hoare_vcg_ball_lift sep_inv_to_all_scheduable_tcbs[OF update_thread_intent_update]
     hoare_vcg_imp_lift hoare_vcg_ex_lift hoare_vcg_all_lift
     update_thread_intent_update update_thread_cnode_at | clarsimp simp:Let_def)+ apply (clarsimp simp:conj_comms) apply (intro conjI impI ballI)[1] apply (clarsimp dest!:sep_map_f_tcb_at simp:object_at_def) apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def) apply (intro conjI,simp+) apply (clarsimp simp:sep_conj_assoc) apply sep_solve apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def) apply (intro conjI allI) apply (simp add:cnode_non_ep cong: cap_type_bad_cong)+ apply (clarsimp simp:sep_conj_assoc) apply sep_solve apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def) apply (intro conjI allI) apply (fastforce cong: cap_type_bad_cong)+ apply (drule(1) reset_cap_asid_cnode_cap | simp)+ apply (clarsimp simp:sep_conj_assoc) apply sep_solve apply clarsimp apply (intro conjI,fastforce cong: cap_type_bad_cong) apply (metis cap_object_reset_cap_asid) apply (fastforce) apply sep_solve apply (clarsimp simp:user_pointer_at_def
          Let_def word_bits_def cnode_cap_non_ep_related) apply (clarsimp simp:sep_conj_assoc) apply fastforce done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. Separation_SD.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap\<rbrace> seL4_CNode_Mutate dest_root dest_index dest_depth src_root src_index src_depth data \<lbrace>\<lambda>_. Separation_SD.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> False) \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> False \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q2\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> False \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)\<rbrace>
 2. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> ?Q2 s proof (prove)
goal (12 subgoals):
 1. cdl_intent_op \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = dest_root \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = [src_root]
 2. \<lbrace>?R5\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)\<rbrace>
 3. \<lbrace>?Ra5\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R5\<rbrace>
 4. \<lbrace>?Rb5\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra5\<rbrace>
 5. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb5 s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 6. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 7. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 8. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 9. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<lbrace>?R5\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)\<rbrace>
 2. \<lbrace>?Ra5\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R5\<rbrace>
 3. \<lbrace>?Rb5\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra5\<rbrace>
 4. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb5 s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 5. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 6. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 7. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 10. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* ?R7) s \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s
 2. \<lbrace>?Ra5\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R7)\<rbrace>
 3. \<lbrace>?Rb5\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra5\<rbrace>
 4. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb5 s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 5. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 6. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 7. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 10. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<lbrace>?Ra5\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)\<rbrace>
 2. \<lbrace>?Rb5\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra5\<rbrace>
 3. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb5 s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 4. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 6. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 9. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 10. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<lbrace>?Rb5\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)\<rbrace>
 2. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb5 s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>iv. \<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<Longrightarrow> \<lbrace>?P'19 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'19 iv and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P'19 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = dest_root \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [src_root]) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'19 iv and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P'19 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ _. False\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'19 iv and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P'30 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id\<rbrace>, -
 2. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P31 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P31 iv and ?P'30 iv and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P31 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P31 iv and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P'41 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound\<rbrace>, -
 2. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P42 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P42 iv and ?P'41 iv and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P42 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P42 iv and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (10 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P42 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>?Q49 dcap\<rbrace>, \<lbrace>?E49 dcap\<rbrace>
 2. \<And>dcap rv s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?Q49 dcap rv s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s
 3. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 4. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P42 iv and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 6. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 9. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 10. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<And>dcap rv s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s
 2. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s
 2. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (10 subgoals):
 1. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s
 2. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 3. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 4. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 6. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 9. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 10. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (10 subgoals):
 1. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s
 2. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 3. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 4. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 6. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 9. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 10. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (11 subgoals):
 1. \<And>dcap s. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> reset_cap_asid (update_cap_data_det data dcap) = reset_cap_asid (update_cap_data_det data src_cap)
 2. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra70 dcap (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s
 3. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 4. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 5. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 6. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 7. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 10. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>dcap. ?Ra70 dcap (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?Ra59 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (10 subgoals):
 1. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra70 dcap (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R) s
 2. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 3. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 4. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 6. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 9. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 10. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?Ra70 dcap (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?Ra59 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (9 subgoals):
 1. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 2. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (7 subgoals):
 1. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 2. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 3. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 6. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 7. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>iv rv s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 iv) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s \<Longrightarrow> (cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 iv) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>s dcap. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s; cdl_current_thread s = Some root_tcb_id; cdl_current_domain s = minBound; reset_cap_asid dcap = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)) s \<and> (\<exists>dcapa. reset_cap_asid dcapa = reset_cap_asid src_cap \<and> update_cap_data_det data dcap = update_cap_data_det data dcapa)
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 iv) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<And>s dcap. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s; cdl_current_thread s = Some root_tcb_id; cdl_current_domain s = minBound; reset_cap_asid dcap = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R)) s
 2. \<And>s dcap. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s; cdl_current_thread s = Some root_tcb_id; cdl_current_domain s = minBound; reset_cap_asid dcap = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>dcapa. reset_cap_asid dcapa = reset_cap_asid src_cap \<and> update_cap_data_det data dcap = update_cap_data_det data dcapa
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 iv) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>s dcap. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s; cdl_current_thread s = Some root_tcb_id; cdl_current_domain s = minBound; reset_cap_asid dcap = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>dcapa. reset_cap_asid dcapa = reset_cap_asid src_cap \<and> update_cap_data_det data dcap = update_cap_data_det data dcapa
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (7 subgoals):
 1. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 2. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 3. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 6. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 7. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>\<lambda>iv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) s\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 2. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 5. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 6. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. is_cnode_cap c \<Longrightarrow> \<lbrace>?P'178 c ref cs\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>\<lambda>iv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) s\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 2. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'178 (fst r) (snd r) xa and K (is_cnode_cap (fst r))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 5. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 6. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. is_cnode_cap c \<Longrightarrow> \<lbrace>?P'178 c ref cs\<rbrace> liftME InvokeCNode (decode_cnode_invocation c ref cs (CNodeMutateIntent dest_index dest_depth src_index src_depth data)) \<lbrace>\<lambda>iv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 2. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'178 (fst r) (snd r) xa and K (is_cnode_cap (fst r))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 5. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 6. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. is_cnode_cap c \<Longrightarrow> \<lbrace>?P'178 c ref cs\<rbrace> decode_cnode_invocation c ref cs (CNodeMutateIntent dest_index dest_depth src_index src_depth data) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 (InvokeCNode r) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> InvokeCNode r = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 2. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'178 (fst r) (snd r) xa and K (is_cnode_cap (fst r))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 5. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 6. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (5 subgoals):
 1. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>a. xa \<noteq> [] \<and> cdl.lift (\<box> (?src_sz183 (fst r) (snd r) xa, unat src_depth) : fst (the $ get_index xa 0) src_index \<mapsto>u ?src_cap183 (fst r) (snd r) xa \<and>* \<box> (?dest_sz183 (fst r) (snd r) xa, unat dest_depth) : fst r dest_index \<mapsto>u NullCap \<and>* ?R183 (fst r) (snd r) xa) a \<and> valid_src_cap (?src_cap183 (fst r) (snd r) xa) data \<and> \<not> ep_related_cap (?src_cap183 (fst r) (snd r) xa) \<and> cap_has_type (?src_cap183 (fst r) (snd r) xa) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap183 (fst r) (snd r) xa) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the $ get_index xa 0)), offset src_index (?src_sz183 (fst r) (snd r) xa)) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) xa)))) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the $ get_index xa 0)), offset src_index (?src_sz183 (fst r) (snd r) xa)) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) xa))) = InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))))) and K (is_cnode_cap (fst r))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 4. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 5. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (5 subgoals):
 1. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id src_root;
returnOk [x]
odE \<lbrace>\<lambda>xa s. xa \<noteq> [] \<and> cdl.lift (\<box> (?src_sz183 (fst r) (snd r) xa, unat src_depth) : fst (the (if xa \<noteq> [] then Some (xa ! 0) else None)) src_index \<mapsto>u ?src_cap183 (fst r) (snd r) xa \<and>* \<box> (?dest_sz183 (fst r) (snd r) xa, unat dest_depth) : fst r dest_index \<mapsto>u NullCap \<and>* ?R183 (fst r) (snd r) xa) s \<and> valid_src_cap (?src_cap183 (fst r) (snd r) xa) data \<and> \<not> ep_related_cap (?src_cap183 (fst r) (snd r) xa) \<and> cap_has_type (?src_cap183 (fst r) (snd r) xa) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap183 (fst r) (snd r) xa) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if xa \<noteq> [] then Some (xa ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) xa)) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) xa)))) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if xa \<noteq> [] then Some (xa ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz183 (fst r) (snd r) xa) = offset src_index root_size \<and> cap_object (fst r) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz183 (fst r) (snd r) xa) = offset dest_index dest_size)) \<and> is_cnode_cap (fst r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 4. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 5. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (6 subgoals):
 1. \<And>r ra. \<lbrace>?P'188 r ra\<rbrace> returnOk [ra] \<lbrace>\<lambda>xa s. xa \<noteq> [] \<and> cdl.lift (\<box> (?src_sz183 (fst r) (snd r) xa, unat src_depth) : fst (the (if xa \<noteq> [] then Some (xa ! 0) else None)) src_index \<mapsto>u ?src_cap183 (fst r) (snd r) xa \<and>* \<box> (?dest_sz183 (fst r) (snd r) xa, unat dest_depth) : fst r dest_index \<mapsto>u NullCap \<and>* ?R183 (fst r) (snd r) xa) s \<and> valid_src_cap (?src_cap183 (fst r) (snd r) xa) data \<and> \<not> ep_related_cap (?src_cap183 (fst r) (snd r) xa) \<and> cap_has_type (?src_cap183 (fst r) (snd r) xa) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap183 (fst r) (snd r) xa) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if xa \<noteq> [] then Some (xa ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) xa)) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) xa)))) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if xa \<noteq> [] then Some (xa ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz183 (fst r) (snd r) xa) = offset src_index root_size \<and> cap_object (fst r) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz183 (fst r) (snd r) xa) = offset dest_index dest_size)) \<and> is_cnode_cap (fst r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id src_root \<lbrace>?P'188 r\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 5. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 6. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (5 subgoals):
 1. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id src_root \<lbrace>\<lambda>ra a. [ra] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz183 (fst r) (snd r) [ra], unat src_depth) : fst (the (if [ra] \<noteq> [] then Some ([ra] ! 0) else None)) src_index \<mapsto>u ?src_cap183 (fst r) (snd r) [ra] \<and>* \<box> (?dest_sz183 (fst r) (snd r) [ra], unat dest_depth) : fst r dest_index \<mapsto>u NullCap \<and>* ?R183 (fst r) (snd r) [ra]) a \<and> valid_src_cap (?src_cap183 (fst r) (snd r) [ra]) data \<and> \<not> ep_related_cap (?src_cap183 (fst r) (snd r) [ra]) \<and> cap_has_type (?src_cap183 (fst r) (snd r) [ra]) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap183 (fst r) (snd r) [ra]) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [ra] \<noteq> [] then Some ([ra] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [ra])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [ra])))) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [ra] \<noteq> [] then Some ([ra] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz183 (fst r) (snd r) [ra]) = offset src_index root_size \<and> cap_object (fst r) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz183 (fst r) (snd r) [ra]) = offset dest_index dest_size)) \<and> is_cnode_cap (fst r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 4. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 5. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (4 subgoals):
 1. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ((\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'236 (fst r) (snd r)) \<longrightarrow> [(c, cap_object (?cap235 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst r) (snd r) c, unat src_depth) : fst (the (if [(c, cap_object (?cap233 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap232 (fst r) (snd r)), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst r) (snd r) c \<and>* \<box> (?dest_sz230 (fst r) (snd r) c, unat dest_depth) : fst r dest_index \<mapsto>u NullCap \<and>* ?R229 (fst r) (snd r) c) s \<and> valid_src_cap (?src_cap228 (fst r) (snd r) c) data \<and> \<not> ep_related_cap (?src_cap227 (fst r) (snd r) c) \<and> cap_has_type (?src_cap226 (fst r) (snd r) c) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst r) (snd r) c) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst r) (snd r) c src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(c, cap_object (?cap223 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap222 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst r) (snd r) c) = offset src_index root_size \<and> cap_object (fst r) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst r) (snd r) c) = offset dest_index dest_size)) \<and> is_cnode_cap (fst r)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst r) (snd r) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst r) (snd r) src_root \<mapsto>u ?cap'217 (fst r) (snd r) \<and>* ?R216 (fst r) (snd r)) s) \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 3. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 4. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'236 (fst r) (snd r)
\<lambda>r. ?cap218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap235 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap233 (fst r) (snd r)
\<lambda>r. ?cap218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap232 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap223 (fst r) (snd r)
\<lambda>r. ?cap218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap222 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap219 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<lbrace>\<lambda>s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) \<longrightarrow> [(ca, cap_object (?cap235 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat src_depth) : fst (the (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz230 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object ?cap237, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R229 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) s \<and> valid_src_cap (?src_cap228 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) data \<and> \<not> ep_related_cap (?src_cap227 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> cap_has_type (?src_cap226 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(ca, cap_object (?cap223 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap222 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap237, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> is_cnode_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) src_root \<mapsto>u ?cap'217 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* ?R216 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 2. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) \<longrightarrow> [(ca, cap_object (?cap235 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat src_depth) : fst (the (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz230 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object ?cap237, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R229 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) s \<and> valid_src_cap (?src_cap228 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) data \<and> \<not> ep_related_cap (?src_cap227 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> cap_has_type (?src_cap226 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(ca, cap_object (?cap223 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap222 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap237, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> is_cnode_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) src_root \<mapsto>u ?cap'217 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* ?R216 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrace>
 3. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<lbrace>\<lambda>s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) \<longrightarrow> [(ca, cap_object (?cap235 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat src_depth) : fst (the (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz230 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object ?cap237, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R229 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) s \<and> valid_src_cap (?src_cap228 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) data \<and> \<not> ep_related_cap (?src_cap227 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> cap_has_type (?src_cap226 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(ca, cap_object (?cap223 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap222 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap237, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> is_cnode_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) src_root \<mapsto>u ?cap'217 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* ?R216 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) \<longrightarrow> [(ca, cap_object (?cap235 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat src_depth) : fst (the (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz230 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object ?cap237, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R229 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) s \<and> valid_src_cap (?src_cap228 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) data \<and> \<not> ep_related_cap (?src_cap227 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> cap_has_type (?src_cap226 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(ca, cap_object (?cap223 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap222 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap237, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> is_cnode_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) src_root \<mapsto>u ?cap'217 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* ?R216 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrace>
 3. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (4 subgoals):
 1. \<lbrace>?Q240\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) \<longrightarrow> [(ca, cap_object (?cap235 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat src_depth) : fst (the (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz230 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object ?cap237, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R229 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) s \<and> valid_src_cap (?src_cap228 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) data \<and> \<not> ep_related_cap (?src_cap227 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> cap_has_type (?src_cap226 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(ca, cap_object (?cap223 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap222 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap237, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> is_cnode_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) src_root \<mapsto>u ?cap'217 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* ?R216 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s \<Longrightarrow> ?Q240 s
 3. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) \<longrightarrow> [(ca, cap_object (?cap235 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat src_depth) : fst (the (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz230 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object ?cap237, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R229 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) s \<and> valid_src_cap (?src_cap228 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) data \<and> \<not> ep_related_cap (?src_cap227 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> cap_has_type (?src_cap226 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(ca, cap_object (?cap223 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap222 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap237, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> is_cnode_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) src_root \<mapsto>u ?cap'217 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* ?R216 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrace>
 4. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) \<longrightarrow> [(ca, cap_object (?cap235 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat src_depth) : fst (the (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz230 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object ?cap237, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R229 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) s \<and> valid_src_cap (?src_cap228 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) data \<and> \<not> ep_related_cap (?src_cap227 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> cap_has_type (?src_cap226 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(ca, cap_object (?cap223 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap222 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap237, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> is_cnode_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) src_root \<mapsto>u ?cap'217 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* ?R216 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap (fst (c, cap_object ?cap243, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
 2. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) \<longrightarrow> [(ca, cap_object (?cap235 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat src_depth) : fst (the (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz230 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object ?cap237, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R229 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) s \<and> valid_src_cap (?src_cap228 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) data \<and> \<not> ep_related_cap (?src_cap227 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> cap_has_type (?src_cap226 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(ca, cap_object (?cap223 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap222 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap237, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> is_cnode_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) src_root \<mapsto>u ?cap'217 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* ?R216 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrace>
 3. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object ?cap237, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object ?cap237, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object ?cap237, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object ?cap237, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object ?cap237, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object ?cap237, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object ?cap237, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object ?cap237, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object ?cap237, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 c (cap_object ?cap237, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
 2. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) \<longrightarrow> [(ca, cap_object (?cap235 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat src_depth) : fst (the (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz230 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object ?cap237, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R229 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) s \<and> valid_src_cap (?src_cap228 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) data \<and> \<not> ep_related_cap (?src_cap227 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> cap_has_type (?src_cap226 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(ca, cap_object (?cap223 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap222 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap237, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> is_cnode_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) src_root \<mapsto>u ?cap'217 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* ?R216 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrace>
 3. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMutateIntent dest_index dest_depth src_index src_depth data)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) \<longrightarrow> [(ca, cap_object (?cap235 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] \<and> cdl.lift (\<box> (?src_sz234 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat src_depth) : fst (the (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None)) src_index \<mapsto>u ?src_cap231 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca \<and>* \<box> (?dest_sz230 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca, unat dest_depth) : fst (c, cap_object ?cap237, offset dest_root root_size) dest_index \<mapsto>u NullCap \<and>* ?R229 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) s \<and> valid_src_cap (?src_cap228 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) data \<and> \<not> ep_related_cap (?src_cap227 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> cap_has_type (?src_cap226 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object (fst (the (if [(ca, cap_object (?cap223 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap222 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))), offset src_root root_size)] ! 0) else None))) = cap_object cnode_cap' \<and> offset src_index (?src_sz221 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap237, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) ca) = offset dest_index dest_size)) \<and> is_cnode_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap218 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) src_root \<mapsto>u ?cap'217 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size)) \<and>* ?R216 (fst (c, cap_object ?cap237, offset dest_root root_size)) (snd (c, cap_object ?cap237, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap237, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrace>
 2. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> cap' = update_cap_data_det data src_cap \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object ?cap237, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object ?cap237, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object ?cap237, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object ?cap237, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object ?cap237, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object ?cap237, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object ?cap237, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object ?cap237, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object ?cap237, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 c (cap_object ?cap237, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> object_at (\<lambda>obj. \<exists>tcb. obj = Tcb tcb) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x = reset_cap_asid ?cap'237 \<longrightarrow> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 x (cap_object ?cap237, offset dest_root root_size) xa, unat src_depth) : xa src_index \<mapsto>u ?src_cap231 x (cap_object ?cap237, offset dest_root root_size) xa \<and>* \<box> (?dest_sz230 x (cap_object ?cap237, offset dest_root root_size) xa, unat dest_depth) : x dest_index \<mapsto>u NullCap \<and>* ?R229 x (cap_object ?cap237, offset dest_root root_size) xa) s \<and> valid_src_cap (?src_cap228 x (cap_object ?cap237, offset dest_root root_size) xa) data \<and> \<not> ep_related_cap (?src_cap227 x (cap_object ?cap237, offset dest_root root_size) xa) \<and> cap_has_type (?src_cap226 x (cap_object ?cap237, offset dest_root root_size) xa) \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object ?cap237, offset dest_root root_size) xa) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object ?cap237, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> cap_object xa = cap_object cnode_cap \<and> offset src_index (?src_sz221 x (cap_object ?cap237, offset dest_root root_size) xa) = offset src_index root_size \<and> cap_object x = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 x (cap_object ?cap237, offset dest_root root_size) xa) = offset dest_index dest_size)) \<and> is_cnode_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 x (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 x (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 x (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 x (cap_object ?cap237, offset dest_root root_size)) s \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s)
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object ?cap237, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object ?cap237, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object ?cap237, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object ?cap237, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object ?cap237, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object ?cap237, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object ?cap237, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object ?cap237, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object ?cap237, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 c (cap_object ?cap237, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> object_at (\<lambda>obj. \<exists>tcb. obj = Tcb tcb) root_tcb_id s \<and> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s \<and> (\<forall>x. reset_cap_asid x = reset_cap_asid ?cap'237 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 x (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 x (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 x (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 x (cap_object ?cap237, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object ?cap237, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object ?cap237, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object ?cap237, offset dest_root root_size) xa) \<and> cdl.lift (\<box> (?src_sz234 x (cap_object ?cap237, offset dest_root root_size) xa, unat src_depth) : xa src_index \<mapsto>u ?src_cap231 x (cap_object ?cap237, offset dest_root root_size) xa \<and>* \<box> (?dest_sz230 x (cap_object ?cap237, offset dest_root root_size) xa, unat dest_depth) : x dest_index \<mapsto>u NullCap \<and>* ?R229 x (cap_object ?cap237, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object ?cap237, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object ?cap237, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object ?cap237, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object ?cap237, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s))))
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object ?cap237, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object ?cap237, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object ?cap237, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object ?cap237, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object ?cap237, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object ?cap237, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object ?cap237, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object ?cap237, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object ?cap237, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 c (cap_object ?cap237, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (4 subgoals):
 1. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type\<rbrakk> \<Longrightarrow> object_at (\<lambda>obj. \<exists>tcb. obj = Tcb tcb) root_tcb_id s
 2. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s
 3. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid ?cap'237 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 x (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 x (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 x (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 x (cap_object ?cap237, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object ?cap237, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object ?cap237, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object ?cap237, offset dest_root root_size) xa) \<and> cdl.lift (\<box> (?src_sz234 x (cap_object ?cap237, offset dest_root root_size) xa, unat src_depth) : xa src_index \<mapsto>u ?src_cap231 x (cap_object ?cap237, offset dest_root root_size) xa \<and>* \<box> (?dest_sz230 x (cap_object ?cap237, offset dest_root root_size) xa, unat dest_depth) : x dest_index \<mapsto>u NullCap \<and>* ?R229 x (cap_object ?cap237, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object ?cap237, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object ?cap237, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object ?cap237, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object ?cap237, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s))
 4. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object ?cap237, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object ?cap237, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object ?cap237, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object ?cap237, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object ?cap237, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object ?cap237, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object ?cap237, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object ?cap237, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object ?cap237, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 c (cap_object ?cap237, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s
 2. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid ?cap'237 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 x (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 x (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 x (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 x (cap_object ?cap237, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object ?cap237, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object ?cap237, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object ?cap237, offset dest_root root_size) xa) \<and> cdl.lift (\<box> (?src_sz234 x (cap_object ?cap237, offset dest_root root_size) xa, unat src_depth) : xa src_index \<mapsto>u ?src_cap231 x (cap_object ?cap237, offset dest_root root_size) xa \<and>* \<box> (?dest_sz230 x (cap_object ?cap237, offset dest_root root_size) xa, unat dest_depth) : x dest_index \<mapsto>u NullCap \<and>* ?R229 x (cap_object ?cap237, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object ?cap237, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object ?cap237, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object ?cap237, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object ?cap237, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s))
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object ?cap237, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object ?cap237, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object ?cap237, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object ?cap237, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object ?cap237, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object ?cap237, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object ?cap237, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object ?cap237, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object ?cap237, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 c (cap_object ?cap237, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> one_lvl_lookup ?cap237 32 root_size \<and> guard_equal ?cap237 dest_root 32 \<and> is_cnode_cap ?cap237 \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* (cap_object ?cap237 \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object ?cap237, offset dest_root root_size) \<mapsto>c ?cap'237) \<and>* ?R237) s
 2. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid ?cap'237 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 x (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 x (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 x (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 x (cap_object ?cap237, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object ?cap237, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object ?cap237, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object ?cap237, offset dest_root root_size) xa) \<and> cdl.lift (\<box> (?src_sz234 x (cap_object ?cap237, offset dest_root root_size) xa, unat src_depth) : xa src_index \<mapsto>u ?src_cap231 x (cap_object ?cap237, offset dest_root root_size) xa \<and>* \<box> (?dest_sz230 x (cap_object ?cap237, offset dest_root root_size) xa, unat dest_depth) : x dest_index \<mapsto>u NullCap \<and>* ?R229 x (cap_object ?cap237, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object ?cap237, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object ?cap237, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object ?cap237, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object ?cap237, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s))
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object ?cap237, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object ?cap237, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object ?cap237, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object ?cap237, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object ?cap237, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object ?cap237, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object ?cap237, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object ?cap237, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object ?cap237, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object ?cap237, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object ?cap237, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object ?cap237, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object ?cap237, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object ?cap237, offset dest_root root_size) \<and>* ?R216 c (cap_object ?cap237, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap237 \<and>* \<box> (root_size, word_bits) : ?cap237 dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c ?cap'237) \<and>* ?R237) s
 2. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid ?cap'237 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 x (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 x (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'217 x (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 x (cap_object cnode_cap, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> cdl.lift (\<box> (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa, unat src_depth) : xa src_index \<mapsto>u ?src_cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and>* \<box> (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa, unat dest_depth) : x dest_index \<mapsto>u NullCap \<and>* ?R229 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s))
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c ?cap'237 \<and>* ?R237) s
 2. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid ?cap'237 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 x (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 x (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'217 x (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 x (cap_object cnode_cap, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> cdl.lift (\<box> (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa, unat src_depth) : xa src_index \<mapsto>u ?src_cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and>* \<box> (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa, unat dest_depth) : x dest_index \<mapsto>u NullCap \<and>* ?R229 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s))
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'237 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u ?cap'237 \<and>* ?R237) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid dest_root_cap \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 x (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 x (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'217 x (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 x (cap_object cnode_cap, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> cdl.lift (\<box> (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa, unat src_depth) : xa src_index \<mapsto>u ?src_cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and>* \<box> (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa, unat dest_depth) : x dest_index \<mapsto>u NullCap \<and>* ?R229 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s))
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s type x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x \<and> one_lvl_lookup (?cap218 x (cap_object cnode_cap, offset dest_root root_size)) 32 root_size \<and> guard_equal (?cap218 x (cap_object cnode_cap, offset dest_root root_size)) src_root 32 \<and> is_cnode_cap (?cap218 x (cap_object cnode_cap, offset dest_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 x (cap_object cnode_cap, offset dest_root root_size) \<and>* (cap_object (?cap218 x (cap_object cnode_cap, offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (?cap218 x (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) \<mapsto>c ?cap'217 x (cap_object cnode_cap, offset dest_root root_size)) \<and>* ?R216 x (cap_object cnode_cap, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup xa (unat src_depth) (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal xa src_index (unat src_depth) \<and> is_cnode_cap xa \<and> one_lvl_lookup x (unat dest_depth) (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x dest_index (unat dest_depth) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object xa \<mapsto>f CNode (empty_cnode (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object xa, offset src_index (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap231 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset dest_index (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R229 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s))
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (7 subgoals):
 1. \<And>s type x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 2. \<And>s type x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> one_lvl_lookup (?cap218 x (cap_object cnode_cap, offset dest_root root_size)) 32 root_size
 3. \<And>s type x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> guard_equal (?cap218 x (cap_object cnode_cap, offset dest_root root_size)) src_root 32
 4. \<And>s type x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> is_cnode_cap (?cap218 x (cap_object cnode_cap, offset dest_root root_size))
 5. \<And>s type x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 x (cap_object cnode_cap, offset dest_root root_size) \<and>* (cap_object (?cap218 x (cap_object cnode_cap, offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (?cap218 x (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) \<mapsto>c ?cap'217 x (cap_object cnode_cap, offset dest_root root_size)) \<and>* ?R216 x (cap_object cnode_cap, offset dest_root root_size)) s
 6. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup xa (unat src_depth) (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal xa src_index (unat src_depth) \<and> is_cnode_cap xa \<and> one_lvl_lookup x (unat dest_depth) (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x dest_index (unat dest_depth) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object xa \<mapsto>f CNode (empty_cnode (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object xa, offset src_index (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap231 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset dest_index (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R229 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s)
 7. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap219 c (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap218 c (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'217 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?cap235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?cap222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object (?cap218 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap218 (fst r) (snd r)
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s type x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c ?cap'217 x (cap_object cnode_cap, offset dest_root root_size)) \<and>* ?R216 x (cap_object cnode_cap, offset dest_root root_size)) s
 2. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup xa (unat src_depth) (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal xa src_index (unat src_depth) \<and> is_cnode_cap xa \<and> one_lvl_lookup x (unat dest_depth) (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x dest_index (unat dest_depth) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object xa \<mapsto>f CNode (empty_cnode (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object xa, offset src_index (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap231 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset dest_index (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R229 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s)
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u ?cap'217 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s type x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c ?cap'217 x (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 x (cap_object cnode_cap, offset dest_root root_size)) s
 2. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> reset_cap_asid xa = reset_cap_asid (?cap'236 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup xa (unat src_depth) (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal xa src_index (unat src_depth) \<and> is_cnode_cap xa \<and> one_lvl_lookup x (unat dest_depth) (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x dest_index (unat dest_depth) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object xa \<mapsto>f CNode (empty_cnode (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object xa, offset src_index (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap231 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset dest_index (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R229 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s)
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'236 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u ?cap'217 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R216 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap'236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'217 (fst r) (snd r)
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> reset_cap_asid xa = reset_cap_asid cnode_cap' \<longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup xa (unat src_depth) (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal xa src_index (unat src_depth) \<and> is_cnode_cap xa \<and> one_lvl_lookup x (unat dest_depth) (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x dest_index (unat dest_depth) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object xa \<mapsto>f CNode (empty_cnode (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object xa, offset src_index (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap231 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset dest_index (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R229 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s)
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap x \<and> \<not> ep_related_cap (?src_cap227 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> valid_src_cap (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) data \<and> cap_has_type (?src_cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup xa (unat src_depth) (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal xa src_index (unat src_depth) \<and> is_cnode_cap xa \<and> one_lvl_lookup x (unat dest_depth) (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x dest_index (unat dest_depth) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object xa \<mapsto>f CNode (empty_cnode (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object xa, offset src_index (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap231 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset dest_index (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R229 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap225 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s)
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u ?src_cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?dest_sz230 c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) data \<and> \<not> ep_related_cap (?src_cap227 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cap_has_type (?src_cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap225 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (13 subgoals):
 1. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap x
 2. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> \<not> ep_related_cap (?src_cap227 x (cap_object cnode_cap, offset dest_root root_size) xa)
 3. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> valid_src_cap (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) data
 4. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cap_has_type (?src_cap226 x (cap_object cnode_cap, offset dest_root root_size) xa)
 5. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup xa (unat src_depth) (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)
 6. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal xa src_index (unat src_depth)
 7. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap xa
 8. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup x (unat dest_depth) (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)
 9. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal x dest_index (unat dest_depth)
 10. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap x
A total of 13 subgoals...
flex-flex pairs:
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (9 subgoals):
 1. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup xa (unat src_depth) (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)
 2. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal xa src_index (unat src_depth)
 3. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap xa
 4. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup x (unat dest_depth) (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)
 5. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal x dest_index (unat dest_depth)
 6. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap x
 7. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object xa \<mapsto>f CNode (empty_cnode (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object xa, offset src_index (?src_sz234 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c src_cap) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset dest_index (?dest_sz230 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R229 x (cap_object cnode_cap, offset dest_root root_size) xa) s
 8. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> reset_cap_asid xb = reset_cap_asid src_cap \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index (?dest_sz220 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset src_index (?src_sz221 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s
 9. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (?src_sz234 c (cap_object cnode_cap, offset dest_root root_size) ca, unat src_depth) : ca src_index \<mapsto>u src_cap \<and>* \<box> (?dest_sz230 c (cap_object cnode_cap, offset dest_root root_size) ca, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index (?src_sz221 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index (?dest_sz220 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?src_sz234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index (?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset dest_index (?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?src_sz221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_sz220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_sz183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s type x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; x = dest_root_cap; xa = cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap) \<and>* (cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap) \<and>* ?R229 dest_root_cap (cap_object cnode_cap, offset dest_root root_size) cnode_cap') s
 2. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> reset_cap_asid xb = reset_cap_asid src_cap \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (root_size, unat src_depth) : ca src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s type. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* ?R229 dest_root_cap (cap_object cnode_cap, offset dest_root root_size) cnode_cap') s
 2. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> reset_cap_asid xb = reset_cap_asid src_cap \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (root_size, unat src_depth) : ca src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R229 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?R229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R183 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> reset_cap_asid xb = reset_cap_asid src_cap \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (root_size, unat src_depth) : ca src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'; reset_cap_asid xb = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object x = cap_object dest_root_cap \<and> cap_object xa = cap_object cnode_cap \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (root_size, unat src_depth) : ca src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (4 subgoals):
 1. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'; reset_cap_asid xb = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cap_object xa = cap_object cnode_cap
 2. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'; reset_cap_asid xb = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap
 3. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'; reset_cap_asid xb = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s
 4. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (root_size, unat src_depth) : ca src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'; reset_cap_asid xb = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> \<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data xb = update_cap_data_det data dcap
 2. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'; reset_cap_asid xb = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (root_size, unat src_depth) : ca src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s type x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; dest_slot = offset dest_index dest_size; cap' = update_cap_data_det data src_cap; valid_src_cap src_cap data; \<not> ep_related_cap src_cap; cap_type src_cap = Some type; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'; reset_cap_asid xb = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap224 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* R))) s
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (root_size, unat src_depth) : ca src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap224 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s
flex-flex pairs:
\<lambda>r. ?cap224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data src_cap') (cap_object (fst (the (if [(c, cap_object cnode_cap, offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object cnode_cap, offset src_root root_size)] ! 0) else None))), offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>dcap. ?cap154 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall (update_cap_data_det data dcap) (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> cdl.lift (\<box> (root_size, unat src_depth) : ca src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c src_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size)) \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* \<box> (root_size, word_bits) : ?cap243 dest_root \<mapsto>u ?cap'243 \<and>* ?R243) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> one_lvl_lookup ca (unat src_depth) root_size \<and> guard_equal ca src_index (unat src_depth) \<and> is_cnode_cap ca \<and> one_lvl_lookup c (unat dest_depth) dest_size \<and> guard_equal c dest_index (unat dest_depth) \<and> is_cnode_cap c \<and> cdl.lift ((cap_object ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object ca, offset src_index root_size) \<mapsto>c src_cap) \<and>* (cap_object c \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object c, offset dest_index dest_size) \<mapsto>c NullCap) \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> 32 \<and> 0 < unat src_depth \<and> unat dest_depth \<le> 32 \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c src_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> cap_object c = cap_object dest_root_cap)) \<and> is_cnode_cap c) \<and> one_lvl_lookup cnode_cap 32 root_size \<and> guard_equal cnode_cap src_root 32 \<and> is_cnode_cap cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap') \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; guard_equal cnode_cap dest_root 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap) \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> one_lvl_lookup ?cap243 32 root_size \<and> guard_equal ?cap243 dest_root 32 \<and> is_cnode_cap ?cap243 \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* (cap_object ?cap243 \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object ?cap243, offset dest_root root_size) \<mapsto>c ?cap'243) \<and>* ?R243) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> one_lvl_lookup ca (unat src_depth) root_size \<and> guard_equal ca src_index (unat src_depth) \<and> is_cnode_cap ca \<and> one_lvl_lookup c (unat dest_depth) dest_size \<and> guard_equal c dest_index (unat dest_depth) \<and> is_cnode_cap c \<and> cdl.lift (cap_object ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object ca, offset src_index root_size) \<mapsto>c src_cap \<and>* cap_object c \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object c, offset dest_index dest_size) \<mapsto>c NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> valid_src_cap src_cap data \<and> \<not> ep_related_cap src_cap \<and> cap_has_type src_cap \<and> unat src_depth \<le> 32 \<and> 0 < unat src_depth \<and> unat dest_depth \<le> 32 \<and> 0 < unat dest_depth \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c src_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c update_cap_data_det data src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c cap' \<and>* R))) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> update_cap_data_det data src_cap' = update_cap_data_det data dcap \<and> cap_object ca = cap_object cnode_cap' \<and> cap_object c = cap_object dest_root_cap)) \<and> is_cnode_cap c) \<and> one_lvl_lookup cnode_cap 32 root_size \<and> guard_equal cnode_cap src_root 32 \<and> is_cnode_cap cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; guard_equal cnode_cap dest_root 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'243 \<longrightarrow> \<not> ep_related_cap c) \<and> one_lvl_lookup ?cap243 32 root_size \<and> guard_equal ?cap243 dest_root 32 \<and> is_cnode_cap ?cap243 \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap243 \<and>* cap_object ?cap243 \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object ?cap243, offset dest_root root_size) \<mapsto>c ?cap'243 \<and>* ?R243) s proof (prove)
goal:
No subgoals!