theory EmptyFail_H

lemma decodeCNodeInvocation_empty_fail[intro!, wp, simp]:
  "empty_fail (decodeCNodeInvocation label args cap exs)" apply (rule_tac label=label and args=args and exs=exs in decode_cnode_cases2) apply (simp_all add: decodeCNodeInvocation_def
                         split_def cnode_invok_case_cleanup unlessE_whenE
                   cong: if_cong bool.case_cong list.case_cong) by (simp | wp | wpc | safe)+

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. empty_fail (decodeCNodeInvocation label args cap exs) proof (prove)
goal (7 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; exs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller}\<rbrakk> \<Longrightarrow> empty_fail (decodeCNodeInvocation label args cap exs)
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> empty_fail (decodeCNodeInvocation label args cap exs)
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> empty_fail (decodeCNodeInvocation label args cap exs)
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> empty_fail (decodeCNodeInvocation label args cap exs)
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> empty_fail (decodeCNodeInvocation label args cap exs)
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; exs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> empty_fail (decodeCNodeInvocation label args cap exs)
 7. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', exs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', exs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> empty_fail (decodeCNodeInvocation label args cap exs) proof (prove)
goal (7 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; exs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> (gen_invocation_type label = CNodeMove \<longrightarrow> isCNodeCap cap \<longrightarrow> empty_fail (doE destSlot <- lookupSlotForCNodeOp False cap index (unat bits);
y <- ensureEmptySlot destSlot;
srcSlot <- lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth);
srcCTE <- liftE (getCTE srcSlot);
y <- whenE (cteCap srcCTE = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth))));
y <- whenE (cteCap srcCTE = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (Move (cteCap srcCTE) srcSlot destSlot)
odE)) \<and> (gen_invocation_type label = CNodeMutate \<longrightarrow> isCNodeCap cap \<longrightarrow> empty_fail (doE destSlot <- lookupSlotForCNodeOp False cap index (unat bits);
y <- ensureEmptySlot destSlot;
srcSlot <- lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth);
srcCTE <- liftE (getCTE srcSlot);
y <- whenE (cteCap srcCTE = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth))));
p <- case args' of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | newData # x \<Rightarrow> returnOk (allRights, Some newData);
y <- whenE ((case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData True w (global.maskCapRights (fst p) (cteCap srcCTE))) = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (Move (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData True w (global.maskCapRights (fst p) (cteCap srcCTE))) srcSlot destSlot)
odE)) \<and> (gen_invocation_type label \<noteq> CNodeMove \<and> gen_invocation_type label \<noteq> CNodeMutate \<longrightarrow> isCNodeCap cap \<longrightarrow> empty_fail (doE destSlot <- lookupSlotForCNodeOp False cap index (unat bits);
y <- ensureEmptySlot destSlot;
srcSlot <- lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth);
srcCTE <- liftE (getCTE srcSlot);
y <- whenE (cteCap srcCTE = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth))));
p <- case gen_invocation_type label of CNodeCopy \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # x \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | CNodeMint \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [rights] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # newData # xa \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | CNodeMove \<Rightarrow> returnOk $ (allRights, Nothing) | CNodeMutate \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newData # x \<Rightarrow> returnOk $ (allRights, Just newData) | _ \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
newCap <- global.deriveCap srcSlot (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData False w (global.maskCapRights (fst p) (cteCap srcCTE)));
y <- whenE (newCap = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (Insert newCap srcSlot destSlot)
odE))
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> isCNodeCap cap \<longrightarrow> empty_fail (doE destSlot <- lookupSlotForCNodeOp False cap index (unat bits);
returnOk (Revoke destSlot)
odE)
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> isCNodeCap cap \<longrightarrow> empty_fail (doE destSlot <- lookupSlotForCNodeOp False cap index (unat bits);
returnOk (Delete destSlot)
odE)
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> isCNodeCap cap \<longrightarrow> empty_fail (doE destSlot <- lookupSlotForCNodeOp False cap index (unat bits);
y <- ensureEmptySlot destSlot;
returnOk (SaveCaller destSlot)
odE)
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> isCNodeCap cap \<longrightarrow> empty_fail (doE destSlot <- lookupSlotForCNodeOp False cap index (unat bits);
cte <- liftE (getCTE destSlot);
y <- whenE (\<not> hasCancelSendRights (cteCap cte)) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (CancelBadgedSends (cteCap cte))
odE)
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; exs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> isCNodeCap cap \<longrightarrow> empty_fail (doE destSlot <- lookupSlotForCNodeOp False cap index (unat bits);
srcSlot <- lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth);
pivotSlot <- lookupSlotForCNodeOp True pivot_root_cap pivot_index (unat pivot_depth);
y <- whenE (pivotSlot = srcSlot \<or> pivotSlot = destSlot) (throwError Fault_H.syscall_error.IllegalOperation);
y <- whenE (srcSlot \<noteq> destSlot) (ensureEmptySlot destSlot);
srcCap <- liftE (liftM cteCap (getCTE srcSlot));
y <- whenE (srcCap = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth))));
pivotCap <- liftE (liftM cteCap (getCTE pivotSlot));
y <- whenE (pivotCap = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat pivot_depth))));
y <- whenE (global.updateCapData True src_new_data srcCap = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
y <- whenE (global.updateCapData True pivot_new_data pivotCap = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (Rotate (global.updateCapData True src_new_data srcCap) (global.updateCapData True pivot_new_data pivotCap) srcSlot pivotSlot destSlot)
odE)
 7. gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<longrightarrow> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller \<and> (case args' of [] \<Rightarrow> True | [src_index] \<Rightarrow> True | src_index # src_depth # args'' \<Rightarrow> case exs of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case args' of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case exs of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False))) \<Longrightarrow> (gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<longrightarrow> isCNodeCap cap \<longrightarrow> empty_fail (case args of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [index] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | index # bits # args \<Rightarrow> doE destSlot <- lookupSlotForCNodeOp False cap index (unat bits);
case gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] of True \<Rightarrow> case gen_invocation_type label of CNodeRevoke \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of ([], xb) \<Rightarrow> returnOk $ Revoke destSlot | ([srcIndex], xb) \<Rightarrow> returnOk $ Revoke destSlot | (srcIndex # srcDepth # args, []) \<Rightarrow> returnOk $ Revoke destSlot | (srcIndex # srcDepth # args, srcRootCap # xa) \<Rightarrow> doE ensureEmptySlot destSlot;
srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
srcCTE <- withoutFailure $ getCTE srcSlot;
whenE (isNullCap $ cteCap srcCTE) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
(rights, capData) <- case (gen_invocation_type label, args) of (CNodeCopy, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeCopy, rights # xa) \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | (CNodeMint, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, [rights]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, rights # newData # x) \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | (CNodeMove, x) \<Rightarrow> returnOk $ (allRights, Nothing) | (CNodeMutate, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMutate, newData # xa) \<Rightarrow> returnOk $ (allRights, Just newData) | (_, x) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
isMove <- returnOk (gen_invocation_type label `~elem~` [CNodeMove, CNodeMutate]);
srcCap <- returnOk (global.maskCapRights rights $ cteCap srcCTE);
newCap <- (if isMove then returnOk else global.deriveCap srcSlot) $ case capData of None \<Rightarrow> srcCap | Some w \<Rightarrow> global.updateCapData isMove w srcCap;
whenE (isNullCap newCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ (if isMove then Move else Insert) newCap srcSlot destSlot
odE | CNodeDelete \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of ([], xb) \<Rightarrow> returnOk $ Delete destSlot | ([srcIndex], xb) \<Rightarrow> returnOk $ Delete destSlot | (srcIndex # srcDepth # args, []) \<Rightarrow> returnOk $ Delete destSlot | (srcIndex # srcDepth # args, srcRootCap # xa) \<Rightarrow> doE ensureEmptySlot destSlot;
srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
srcCTE <- withoutFailure $ getCTE srcSlot;
whenE (isNullCap $ cteCap srcCTE) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
(rights, capData) <- case (gen_invocation_type label, args) of (CNodeCopy, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeCopy, rights # xa) \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | (CNodeMint, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, [rights]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, rights # newData # x) \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | (CNodeMove, x) \<Rightarrow> returnOk $ (allRights, Nothing) | (CNodeMutate, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMutate, newData # xa) \<Rightarrow> returnOk $ (allRights, Just newData) | (_, x) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
isMove <- returnOk (gen_invocation_type label `~elem~` [CNodeMove, CNodeMutate]);
srcCap <- returnOk (global.maskCapRights rights $ cteCap srcCTE);
newCap <- (if isMove then returnOk else global.deriveCap srcSlot) $ case capData of None \<Rightarrow> srcCap | Some w \<Rightarrow> global.updateCapData isMove w srcCap;
whenE (isNullCap newCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ (if isMove then Move else Insert) newCap srcSlot destSlot
odE | CNodeCancelBadgedSends \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of ([], xb) \<Rightarrow> doE cte <- withoutFailure $ getCTE destSlot;
unlessE (hasCancelSendRights $ cteCap cte) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ CancelBadgedSends $ cteCap cte
odE | ([srcIndex], xb) \<Rightarrow> doE cte <- withoutFailure $ getCTE destSlot;
unlessE (hasCancelSendRights $ cteCap cte) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ CancelBadgedSends $ cteCap cte
odE | (srcIndex # srcDepth # args, []) \<Rightarrow> doE cte <- withoutFailure $ getCTE destSlot;
unlessE (hasCancelSendRights $ cteCap cte) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ CancelBadgedSends $ cteCap cte
odE | (srcIndex # srcDepth # args, srcRootCap # xa) \<Rightarrow> doE ensureEmptySlot destSlot;
srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
srcCTE <- withoutFailure $ getCTE srcSlot;
whenE (isNullCap $ cteCap srcCTE) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
(rights, capData) <- case (gen_invocation_type label, args) of (CNodeCopy, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeCopy, rights # xa) \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | (CNodeMint, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, [rights]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, rights # newData # x) \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | (CNodeMove, x) \<Rightarrow> returnOk $ (allRights, Nothing) | (CNodeMutate, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMutate, newData # xa) \<Rightarrow> returnOk $ (allRights, Just newData) | (_, x) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
isMove <- returnOk (gen_invocation_type label `~elem~` [CNodeMove, CNodeMutate]);
srcCap <- returnOk (global.maskCapRights rights $ cteCap srcCTE);
newCap <- (if isMove then returnOk else global.deriveCap srcSlot) $ case capData of None \<Rightarrow> srcCap | Some w \<Rightarrow> global.updateCapData isMove w srcCap;
whenE (isNullCap newCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ (if isMove then Move else Insert) newCap srcSlot destSlot
odE | CNodeRotate \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of ([], b) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([srcIndex], b) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([srcIndex, srcDepth], []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([srcIndex, srcDepth], srcRootCap # xa) \<Rightarrow> doE ensureEmptySlot destSlot;
srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
srcCTE <- withoutFailure $ getCTE srcSlot;
whenE (isNullCap $ cteCap srcCTE) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
(rights, capData) <- case (gen_invocation_type label, []) of (CNodeCopy, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeCopy, rights # xa) \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | (CNodeMint, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, [rights]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, rights # newData # x) \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | (CNodeMove, x) \<Rightarrow> returnOk $ (allRights, Nothing) | (CNodeMutate, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMutate, newData # xa) \<Rightarrow> returnOk $ (allRights, Just newData) | (_, x) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
isMove <- returnOk (gen_invocation_type label `~elem~` [CNodeMove, CNodeMutate]);
srcCap <- returnOk (global.maskCapRights rights $ cteCap srcCTE);
newCap <- (if isMove then returnOk else global.deriveCap srcSlot) $ case capData of None \<Rightarrow> srcCap | Some w \<Rightarrow> global.updateCapData isMove w srcCap;
whenE (isNullCap newCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ (if isMove then Move else Insert) newCap srcSlot destSlot
odE | ([srcIndex, srcDepth, aa], []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([srcIndex, srcDepth, aa], srcRootCap # xa) \<Rightarrow> doE ensureEmptySlot destSlot;
srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
srcCTE <- withoutFailure $ getCTE srcSlot;
whenE (isNullCap $ cteCap srcCTE) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
(rights, capData) <- case (gen_invocation_type label, [aa]) of (CNodeCopy, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeCopy, rights # xa) \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | (CNodeMint, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, [rights]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, rights # newData # x) \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | (CNodeMove, x) \<Rightarrow> returnOk $ (allRights, Nothing) | (CNodeMutate, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMutate, newData # xa) \<Rightarrow> returnOk $ (allRights, Just newData) | (_, x) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
isMove <- returnOk (gen_invocation_type label `~elem~` [CNodeMove, CNodeMutate]);
srcCap <- returnOk (global.maskCapRights rights $ cteCap srcCTE);
newCap <- (if isMove then returnOk else global.deriveCap srcSlot) $ case capData of None \<Rightarrow> srcCap | Some w \<Rightarrow> global.updateCapData isMove w srcCap;
whenE (isNullCap newCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ (if isMove then Move else Insert) newCap srcSlot destSlot
odE | ([srcIndex, srcDepth, aa, ad], []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([srcIndex, srcDepth, aa, ad], srcRootCap # xa) \<Rightarrow> doE ensureEmptySlot destSlot;
srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
srcCTE <- withoutFailure $ getCTE srcSlot;
whenE (isNullCap $ cteCap srcCTE) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
(rights, capData) <- case (gen_invocation_type label, [aa, ad]) of (CNodeCopy, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeCopy, rights # xa) \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | (CNodeMint, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, [rights]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, rights # newData # x) \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | (CNodeMove, x) \<Rightarrow> returnOk $ (allRights, Nothing) | (CNodeMutate, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMutate, newData # xa) \<Rightarrow> returnOk $ (allRights, Just newData) | (_, x) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
isMove <- returnOk (gen_invocation_type label `~elem~` [CNodeMove, CNodeMutate]);
srcCap <- returnOk (global.maskCapRights rights $ cteCap srcCTE);
newCap <- (if isMove then returnOk else global.deriveCap srcSlot) $ case capData of None \<Rightarrow> srcCap | Some w \<Rightarrow> global.updateCapData isMove w srcCap;
whenE (isNullCap newCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ (if isMove then Move else Insert) newCap srcSlot destSlot
odE | ([srcIndex, srcDepth, aa, ad, af], []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([srcIndex, srcDepth, aa, ad, af], srcRootCap # xa) \<Rightarrow> doE ensureEmptySlot destSlot;
srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
srcCTE <- withoutFailure $ getCTE srcSlot;
whenE (isNullCap $ cteCap srcCTE) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
(rights, capData) <- case (gen_invocation_type label, [aa, ad, af]) of (CNodeCopy, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeCopy, rights # xa) \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | (CNodeMint, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, [rights]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, rights # newData # x) \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | (CNodeMove, x) \<Rightarrow> returnOk $ (allRights, Nothing) | (CNodeMutate, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMutate, newData # xa) \<Rightarrow> returnOk $ (allRights, Just newData) | (_, x) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
isMove <- returnOk (gen_invocation_type label `~elem~` [CNodeMove, CNodeMutate]);
srcCap <- returnOk (global.maskCapRights rights $ cteCap srcCTE);
newCap <- (if isMove then returnOk else global.deriveCap srcSlot) $ case capData of None \<Rightarrow> srcCap | Some w \<Rightarrow> global.updateCapData isMove w srcCap;
whenE (isNullCap newCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ (if isMove then Move else Insert) newCap srcSlot destSlot
odE | (srcIndex # srcDepth # aa # ad # af # ah # lista, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (srcIndex # srcDepth # aa # ad # af # ah # lista, srcRootCap # xa) \<Rightarrow> doE ensureEmptySlot destSlot;
srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
srcCTE <- withoutFailure $ getCTE srcSlot;
whenE (isNullCap $ cteCap srcCTE) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
(rights, capData) <- case (gen_invocation_type label, aa # ad # af # ah # lista) of (CNodeCopy, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeCopy, rights # xa) \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | (CNodeMint, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, [rights]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, rights # newData # x) \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | (CNodeMove, x) \<Rightarrow> returnOk $ (allRights, Nothing) | (CNodeMutate, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMutate, newData # xa) \<Rightarrow> returnOk $ (allRights, Just newData) | (_, x) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
isMove <- returnOk (gen_invocation_type label `~elem~` [CNodeMove, CNodeMutate]);
srcCap <- returnOk (global.maskCapRights rights $ cteCap srcCTE);
newCap <- (if isMove then returnOk else global.deriveCap srcSlot) $ case capData of None \<Rightarrow> srcCap | Some w \<Rightarrow> global.updateCapData isMove w srcCap;
whenE (isNullCap newCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ (if isMove then Move else Insert) newCap srcSlot destSlot
odE | CNodeSaveCaller \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of ([], xb) \<Rightarrow> doE ensureEmptySlot destSlot;
returnOk $ SaveCaller destSlot
odE | ([srcIndex], xb) \<Rightarrow> doE ensureEmptySlot destSlot;
returnOk $ SaveCaller destSlot
odE | (srcIndex # srcDepth # args, []) \<Rightarrow> doE ensureEmptySlot destSlot;
returnOk $ SaveCaller destSlot
odE | (srcIndex # srcDepth # args, srcRootCap # xa) \<Rightarrow> doE ensureEmptySlot destSlot;
srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
srcCTE <- withoutFailure $ getCTE srcSlot;
whenE (isNullCap $ cteCap srcCTE) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
(rights, capData) <- case (gen_invocation_type label, args) of (CNodeCopy, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeCopy, rights # xa) \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | (CNodeMint, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, [rights]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, rights # newData # x) \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | (CNodeMove, x) \<Rightarrow> returnOk $ (allRights, Nothing) | (CNodeMutate, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMutate, newData # xa) \<Rightarrow> returnOk $ (allRights, Just newData) | (_, x) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
isMove <- returnOk (gen_invocation_type label `~elem~` [CNodeMove, CNodeMutate]);
srcCap <- returnOk (global.maskCapRights rights $ cteCap srcCTE);
newCap <- (if isMove then returnOk else global.deriveCap srcSlot) $ case capData of None \<Rightarrow> srcCap | Some w \<Rightarrow> global.updateCapData isMove w srcCap;
whenE (isNullCap newCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ (if isMove then Move else Insert) newCap srcSlot destSlot
odE | _ \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of ([], b) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([srcIndex], b) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (srcIndex # srcDepth # args, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (srcIndex # srcDepth # args, srcRootCap # xa) \<Rightarrow> doE ensureEmptySlot destSlot;
srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
srcCTE <- withoutFailure $ getCTE srcSlot;
whenE (isNullCap $ cteCap srcCTE) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
(rights, capData) <- case (gen_invocation_type label, args) of (CNodeCopy, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeCopy, rights # xa) \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | (CNodeMint, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, [rights]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMint, rights # newData # x) \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | (CNodeMove, x) \<Rightarrow> returnOk $ (allRights, Nothing) | (CNodeMutate, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (CNodeMutate, newData # xa) \<Rightarrow> returnOk $ (allRights, Just newData) | (_, x) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
isMove <- returnOk (gen_invocation_type label `~elem~` [CNodeMove, CNodeMutate]);
srcCap <- returnOk (global.maskCapRights rights $ cteCap srcCTE);
newCap <- (if isMove then returnOk else global.deriveCap srcSlot) $ case capData of None \<Rightarrow> srcCap | Some w \<Rightarrow> global.updateCapData isMove w srcCap;
whenE (isNullCap newCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ (if isMove then Move else Insert) newCap srcSlot destSlot
odE | False \<Rightarrow> case gen_invocation_type label of CNodeRevoke \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of (xa, xb) \<Rightarrow> returnOk $ Revoke destSlot | CNodeDelete \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of (xa, xb) \<Rightarrow> returnOk $ Delete destSlot | CNodeCancelBadgedSends \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of (xa, xb) \<Rightarrow> doE cte <- withoutFailure $ getCTE destSlot;
unlessE (hasCancelSendRights $ cteCap cte) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ CancelBadgedSends $ cteCap cte
odE | CNodeRotate \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of ([], b) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([pivotNewData], b) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([pivotNewData, pivotIndex], b) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([pivotNewData, pivotIndex, pivotDepth], b) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([pivotNewData, pivotIndex, pivotDepth, srcNewData], b) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([pivotNewData, pivotIndex, pivotDepth, srcNewData, srcIndex], b) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (pivotNewData # pivotIndex # pivotDepth # srcNewData # srcIndex # srcDepth # xa, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (pivotNewData # pivotIndex # pivotDepth # srcNewData # srcIndex # srcDepth # xa, [pivotRootCap]) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (pivotNewData # pivotIndex # pivotDepth # srcNewData # srcIndex # srcDepth # xa, pivotRootCap # srcRootCap # xb) \<Rightarrow> doE srcSlot <- lookupSourceSlot srcRootCap (CPtr srcIndex) (fromIntegral srcDepth);
pivotSlot <- lookupPivotSlot pivotRootCap (CPtr pivotIndex) (fromIntegral pivotDepth);
whenE (pivotSlot = srcSlot \<or> pivotSlot = destSlot) $ throw Fault_H.syscall_error.IllegalOperation;
unlessE (srcSlot = destSlot) $ ensureEmptySlot destSlot;
srcCap <- withoutFailure $ liftM cteCap $ getCTE srcSlot;
whenE (isNullCap srcCap) $ throw $ Fault_H.syscall_error.FailedLookup True $ Fault_H.lookup_failure.MissingCapability (fromIntegral srcDepth);
pivotCap <- withoutFailure $ liftM cteCap $ getCTE pivotSlot;
whenE (isNullCap pivotCap) $ throw $ Fault_H.syscall_error.FailedLookup False $ Fault_H.lookup_failure.MissingCapability (fromIntegral pivotDepth);
newSrcCap <- returnOk (global.updateCapData True srcNewData srcCap);
newPivotCap <- returnOk (global.updateCapData True pivotNewData pivotCap);
whenE (isNullCap newSrcCap) $ throw Fault_H.syscall_error.IllegalOperation;
whenE (isNullCap newPivotCap) $ throw Fault_H.syscall_error.IllegalOperation;
returnOk $ Rotate newSrcCap newPivotCap srcSlot pivotSlot destSlot
odE | CNodeSaveCaller \<Rightarrow> case snd (snd (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate], gen_invocation_type label, args, exs)) of (xa, xb) \<Rightarrow> doE ensureEmptySlot destSlot;
returnOk $ SaveCaller destSlot
odE | _ \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage
odE)) \<and> (gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<longrightarrow> isCNodeCap cap \<longrightarrow> empty_fail (case args of [] \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation | [index] \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation | index # _ \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation))