theory CNodeInv_R

lemma decodeCNodeInv_wf[wp]:
  "\<lbrace>invs' and valid_cap' (CNodeCap w n w2 n2)
          and (\<lambda>s. \<forall>r\<in>cte_refs' (CNodeCap w n w2 n2) (irq_node' s).
                     ex_cte_cap_to' r s)
          and (\<lambda>s. \<forall>cap \<in> set cs. s \<turnstile>' cap)
          and (\<lambda>s. \<forall>cap \<in> set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_to' r s)\<rbrace>
     decodeCNodeInvocation label args
     (CNodeCap w n w2 n2) cs
   \<lbrace>valid_cnode_inv'\<rbrace>, -" apply (rule decode_cnode_cases2[where label=label and args=args and exs=cs])
        \<comment> \<open>Move/Insert\<close> apply (simp add: decodeCNodeInvocation_def isCNodeCap_CNodeCap
                         split_def cnode_invok_case_cleanup unlessE_whenE
                   cong: if_cong bool.case_cong list.case_cong) apply (rule hoare_pre) apply (wp whenE_throwError_wp) apply (rule deriveCap_Null_helper) apply (simp add: imp_conjR) apply ((wp deriveCap_derived deriveCap_untyped_derived
                 | wp (once) hoare_drop_imps)+)[1] apply (wp whenE_throwError_wp getCTE_wp | wpc | simp(no_asm))+ apply (rule_tac Q'="\<lambda>rv. invs' and cte_wp_at' (\<lambda>cte. cteCap cte = NullCap) destSlot
                                          and ex_cte_cap_to' destSlot"
                                   in hoare_post_imp_R, wp) apply (clarsimp simp: cte_wp_at_ctes_of) apply (frule invs_valid_objs') apply (simp add: ctes_of_valid' valid_updateCapDataI
                            weak_derived_updateCapData capBadge_updateCapData_True
                            badge_derived_updateCapData
                            badge_derived_mask untyped_derived_eq_maskCapRights
                            untyped_derived_eq_updateCapData
                            untyped_derived_eq_refl) apply (auto simp:isCap_simps updateCapData_def)[1] apply (wp ensureEmptySlot_stronger | simp | wp (once) hoare_drop_imps)+
       \<comment> \<open>Revoke\<close> apply (simp add: decodeCNodeInvocation_def isCNodeCap_CNodeCap split_def
                        unlessE_whenE
                  cong: if_cong bool.case_cong list.case_cong) apply (rule hoare_pre) apply (wp lsfco_cte_at' | simp)+ apply clarsimp
      \<comment> \<open>Delete\<close> apply (simp add: decodeCNodeInvocation_def isCNodeCap_CNodeCap split_def
                       unlessE_whenE
                 cong: if_cong bool.case_cong list.case_cong) apply (rule hoare_pre) apply (wp lsfco_cte_at' | simp)+ apply clarsimp
     \<comment> \<open>SaveCaller\<close> apply (simp add: decodeCNodeInvocation_def isCNodeCap_CNodeCap split_def
                      unlessE_whenE) apply (rule hoare_pre) apply (wp lsfco_cte_at' | simp | wp (once) hoare_drop_imps)+
    \<comment> \<open>CancelBadgedSends\<close> apply (simp add: decodeCNodeInvocation_def isCNodeCap_CNodeCap split_def
                     unlessE_whenE) apply (rule hoare_pre) apply (wp whenE_throwError_wp getCTE_wp | simp)+ apply (rule_tac Q'="\<lambda>rv s. invs' s \<and> cte_wp_at' (\<lambda>_. True) rv s" in hoare_post_imp_R) apply (wp lsfco_cte_at') apply (simp add: cte_wp_at_ctes_of imp_ex hasCancelSendRights_not_Null) apply (clarsimp simp: ctes_of_valid' invs_valid_objs') apply (simp add: invs_valid_objs')
   \<comment> \<open>Rotate\<close> apply (simp add: decodeCNodeInvocation_def isCNodeCap_CNodeCap split_def
                    unlessE_def) apply (rule hoare_pre) apply (wp whenE_throwError_wp getCTE_wp ensureEmptySlot_stronger
                   | simp add: o_def)+ apply (rule_tac Q'="\<lambda>rv s. cte_at' rv s \<and> cte_at' destSlot s
                              \<and> cte_at' srcSlot s \<and> ex_cte_cap_to' rv s
                              \<and> ex_cte_cap_to' destSlot s
                              \<and> invs' s" in hoare_post_imp_R) apply (wp lsfco_cte_at') apply (clarsimp simp: cte_wp_at_ctes_of) apply (frule invs_valid_objs') apply (simp add: weak_derived_updateCapData capBadge_updateCapData_True
                       valid_updateCapDataI ctes_of_valid') apply (fastforce simp:isCap_simps updateCapData_def) apply (wp lsfco_cte_at')+ apply clarsimp
  \<comment> \<open>Errors\<close> apply (elim disjE exE conjE,
         simp_all add: decodeCNodeInvocation_def isCNodeCap_CNodeCap
                       unlessE_whenE cnode_invok_case_cleanup
                split: list.split_asm list.split) by (auto simp: valid_def validE_def validE_R_def in_monad)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller}\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
y <- ensureEmptySlot destSlot;
srcSlot <- lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth);
srcCTE <- liftE (getCTE srcSlot);
y <- whenE (cteCap srcCTE = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth))));
p <- case gen_invocation_type label of CNodeCopy \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # x \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | CNodeMint \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [rights] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # newData # xa \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | CNodeMove \<Rightarrow> returnOk $ (allRights, Nothing) | CNodeMutate \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newData # x \<Rightarrow> returnOk $ (allRights, Just newData) | _ \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
newCap <- (if gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate then returnOk else global.deriveCap srcSlot) (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE)));
y <- whenE (newCap = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk ((if gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate then Move else Insert) newCap srcSlot destSlot)
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (8 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
y <- ensureEmptySlot destSlot;
srcSlot <- lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth);
srcCTE <- liftE (getCTE srcSlot);
y <- whenE (cteCap srcCTE = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth))));
p <- case gen_invocation_type label of CNodeCopy \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # x \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | CNodeMint \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [rights] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # newData # xa \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | CNodeMove \<Rightarrow> returnOk $ (allRights, Nothing) | CNodeMutate \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newData # x \<Rightarrow> returnOk $ (allRights, Just newData) | _ \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage;
newCap <- (if gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate then returnOk else global.deriveCap srcSlot) (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE)));
y <- whenE (newCap = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk ((if gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate then Move else Insert) newCap srcSlot destSlot)
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 8. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (14 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya p. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; \<not> (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate)\<rbrakk> \<Longrightarrow> \<lbrace>?R56 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya p\<rbrace> global.deriveCap srcSlot (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) \<lbrace>\<lambda>newCap s. newCap \<noteq> capability.NullCap \<longrightarrow> valid_cnode_inv' ((if gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate then Move else Insert) newCap srcSlot destSlot) s\<rbrace>, -
 2. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B47 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya\<rbrace> case gen_invocation_type label of CNodeCopy \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # x \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | CNodeMint \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [rights] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # newData # xa \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | CNodeMove \<Rightarrow> returnOk $ (allRights, Nothing) | CNodeMutate \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newData # x \<Rightarrow> returnOk $ (allRights, Just newData) | _ \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage \<lbrace>\<lambda>p s. True \<and> (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate \<longrightarrow> (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) \<noteq> capability.NullCap \<longrightarrow> valid_cnode_inv' ((if gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate then Move else Insert) (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) srcSlot destSlot) s) \<and> (\<not> (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) \<longrightarrow> ?R56 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya p s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B46 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE\<rbrace> whenE (cteCap srcCTE = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth)))) \<lbrace>?B47 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B45 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot\<rbrace> liftE (getCTE srcSlot) \<lbrace>?B46 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B44 index bits src_index src_depth args' src_root_cap exs' destSlot y\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>?B45 index bits src_index src_depth args' src_root_cap exs' destSlot y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace> ensureEmptySlot destSlot \<lbrace>?B44 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 9. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 10. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya p. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; \<not> (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate)\<rbrakk> \<Longrightarrow> \<lbrace>?P59 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya p\<rbrace> global.deriveCap srcSlot (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) \<lbrace>\<lambda>newCap s. newCap \<noteq> capability.NullCap \<longrightarrow> valid_cnode_inv' ((if gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate then Move else Insert) newCap srcSlot destSlot) s\<rbrace>, -
 2. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B47 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya\<rbrace> case gen_invocation_type label of CNodeCopy \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # x \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | CNodeMint \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [rights] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # newData # xa \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | CNodeMove \<Rightarrow> returnOk $ (allRights, Nothing) | CNodeMutate \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newData # x \<Rightarrow> returnOk $ (allRights, Just newData) | _ \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage \<lbrace>\<lambda>p s. True \<and> (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate \<longrightarrow> (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) \<noteq> capability.NullCap \<longrightarrow> valid_cnode_inv' ((if gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate then Move else Insert) (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) srcSlot destSlot) s) \<and> (\<not> (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) \<longrightarrow> (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) \<noteq> capability.NullCap \<longrightarrow> ?P59 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya p s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B46 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE\<rbrace> whenE (cteCap srcCTE = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth)))) \<lbrace>?B47 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B45 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot\<rbrace> liftE (getCTE srcSlot) \<lbrace>?B46 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B44 index bits src_index src_depth args' src_root_cap exs' destSlot y\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>?B45 index bits src_index src_depth args' src_root_cap exs' destSlot y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace> ensureEmptySlot destSlot \<lbrace>?B44 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 9. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 10. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot srcSlot srcCTE p. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; gen_invocation_type label \<noteq> CNodeMove \<and> gen_invocation_type label \<noteq> CNodeMutate\<rbrakk> \<Longrightarrow> \<lbrace>?P59 index bits src_index src_depth args' src_root_cap exs' destSlot () srcSlot srcCTE () p\<rbrace> global.deriveCap srcSlot (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData False w (global.maskCapRights (fst p) (cteCap srcCTE))) \<lbrace>\<lambda>newCap s. (newCap \<noteq> capability.NullCap \<longrightarrow> valid_cap' newCap s) \<and> (newCap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) srcSlot newCap \<circ> cteCap) srcSlot s) \<and> (newCap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (untyped_derived_eq newCap \<circ> cteCap) srcSlot s) \<and> (newCap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s) \<and> (newCap \<noteq> capability.NullCap \<longrightarrow> srcSlot \<noteq> destSlot) \<and> (newCap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s)\<rbrace>, -
 2. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B47 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya\<rbrace> case gen_invocation_type label of CNodeCopy \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # x \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | CNodeMint \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [rights] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # newData # xa \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | CNodeMove \<Rightarrow> returnOk $ (allRights, Nothing) | CNodeMutate \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newData # x \<Rightarrow> returnOk $ (allRights, Just newData) | _ \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage \<lbrace>\<lambda>p s. True \<and> (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate \<longrightarrow> (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) \<noteq> capability.NullCap \<longrightarrow> valid_cnode_inv' ((if gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate then Move else Insert) (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) srcSlot destSlot) s) \<and> (\<not> (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) \<longrightarrow> (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) \<noteq> capability.NullCap \<longrightarrow> ?P59 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya p s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B46 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE\<rbrace> whenE (cteCap srcCTE = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth)))) \<lbrace>?B47 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B45 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot\<rbrace> liftE (getCTE srcSlot) \<lbrace>?B46 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B44 index bits src_index src_depth args' src_root_cap exs' destSlot y\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>?B45 index bits src_index src_depth args' src_root_cap exs' destSlot y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace> ensureEmptySlot destSlot \<lbrace>?B44 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 9. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 10. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B47 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE ya\<rbrace> case gen_invocation_type label of CNodeCopy \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # x \<Rightarrow> returnOk $ (rightsFromWord rights, Nothing) | CNodeMint \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [rights] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | rights # newData # xa \<Rightarrow> returnOk $ (rightsFromWord rights, Just newData) | CNodeMove \<Rightarrow> returnOk $ (allRights, Nothing) | CNodeMutate \<Rightarrow> case snd (gen_invocation_type label, args') of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newData # x \<Rightarrow> returnOk $ (allRights, Just newData) | _ \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage \<lbrace>\<lambda>p s. True \<and> (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate \<longrightarrow> (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) \<noteq> capability.NullCap \<longrightarrow> valid_cnode_inv' ((if gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate then Move else Insert) (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) srcSlot destSlot) s) \<and> (\<not> (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) \<longrightarrow> (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData (gen_invocation_type label = CNodeMove \<or> gen_invocation_type label = CNodeMutate) w (global.maskCapRights (fst p) (cteCap srcCTE))) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData False w (global.maskCapRights (fst p) (cteCap srcCTE))) s \<and> ((case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData False w (global.maskCapRights (fst p) (cteCap srcCTE))) \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData False w (global.maskCapRights (fst p) (cteCap srcCTE))) (cteCap cte) \<and> capASID (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData False w (global.maskCapRights (fst p) (cteCap srcCTE))) = capASID (cteCap cte) \<and> cap_asid_base' (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData False w (global.maskCapRights (fst p) (cteCap srcCTE))) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData False w (global.maskCapRights (fst p) (cteCap srcCTE))) = cap_vptr' (cteCap cte)) srcSlot s \<and> valid_objs' s) \<and> cte_wp_at' (\<lambda>cte. untyped_derived_eq (case snd p of None \<Rightarrow> global.maskCapRights (fst p) (cteCap srcCTE) | Some w \<Rightarrow> global.updateCapData False w (global.maskCapRights (fst p) (cteCap srcCTE))) (cteCap cte)) srcSlot s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<and> srcSlot \<noteq> destSlot \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B46 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE\<rbrace> whenE (cteCap srcCTE = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth)))) \<lbrace>?B47 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot srcCTE\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B45 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot\<rbrace> liftE (getCTE srcSlot) \<lbrace>?B46 index bits src_index src_depth args' src_root_cap exs' destSlot y srcSlot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot y. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B44 index bits src_index src_depth args' src_root_cap exs' destSlot y\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>?B45 index bits src_index src_depth args' src_root_cap exs' destSlot y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace> ensureEmptySlot destSlot \<lbrace>?B44 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 8. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 9. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 10. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
A total of 13 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'428 index bits src_index src_depth args' src_root_cap exs' destSlot ()\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rv s \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> (gen_invocation_type label = CNodeCopy \<longrightarrow> (\<forall>x. (\<exists>xa. args' = x # xa) \<longrightarrow> valid_cap' (cteCap cte) s \<and> cte_wp_at' (\<lambda>ctea. badge_derived' (cteCap cte) (cteCap ctea) \<and> capASID (cteCap cte) = capASID (cteCap ctea) \<and> cap_asid_base' (cteCap cte) = cap_asid_base' (cteCap ctea) \<and> cap_vptr' (cteCap cte) = cap_vptr' (cteCap ctea)) rv s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>ctea. untyped_derived_eq (global.maskCapRights (rightsFromWord x) (cteCap cte)) (cteCap ctea)) rv s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<and> rv \<noteq> destSlot \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s)) \<and> (gen_invocation_type label = CNodeMint \<longrightarrow> (\<forall>x xa. args' = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap cte)) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap cte))) s \<and> cte_wp_at' (\<lambda>ctea. badge_derived' (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap cte))) (cteCap ctea) \<and> capASID (cteCap cte) = capASID (cteCap ctea) \<and> cap_asid_base' (cteCap cte) = cap_asid_base' (cteCap ctea) \<and> cap_vptr' (cteCap cte) = cap_vptr' (cteCap ctea)) rv s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>ctea. untyped_derived_eq (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap cte))) (cteCap ctea)) rv s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<and> rv \<noteq> destSlot \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s))) \<and> (gen_invocation_type label = CNodeMove \<longrightarrow> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c)) rv s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = cteCap cte) rv s \<and> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) rv s \<and> valid_cap' (cteCap cte) s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s) \<and> (gen_invocation_type label = CNodeMutate \<longrightarrow> (\<forall>x. (\<exists>xa. args' = x # xa) \<longrightarrow> global.updateCapData True x (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True x (cteCap cte)) (cteCap c)) rv s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True x (cteCap cte)) rv s \<and> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) rv s \<and> valid_cap' (global.updateCapData True x (cteCap cte)) s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s))))\<rbrace>, -
 2. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace> ensureEmptySlot destSlot \<lbrace>\<lambda>y s. True \<and> True \<and> ?P'428 index bits src_index src_depth args' src_root_cap exs' destSlot y s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 8. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 10. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot rv s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) destSlot and ex_cte_cap_wp_to' (\<lambda>_. True) destSlot) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rv s \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> (gen_invocation_type label = CNodeCopy \<longrightarrow> (\<forall>x. (\<exists>xa. args' = x # xa) \<longrightarrow> valid_cap' (cteCap cte) s \<and> cte_wp_at' (\<lambda>ctea. badge_derived' (cteCap cte) (cteCap ctea) \<and> capASID (cteCap cte) = capASID (cteCap ctea) \<and> cap_asid_base' (cteCap cte) = cap_asid_base' (cteCap ctea) \<and> cap_vptr' (cteCap cte) = cap_vptr' (cteCap ctea)) rv s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>ctea. untyped_derived_eq (global.maskCapRights (rightsFromWord x) (cteCap cte)) (cteCap ctea)) rv s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<and> rv \<noteq> destSlot \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s)) \<and> (gen_invocation_type label = CNodeMint \<longrightarrow> (\<forall>x xa. args' = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap cte)) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap cte))) s \<and> cte_wp_at' (\<lambda>ctea. badge_derived' (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap cte))) (cteCap ctea) \<and> capASID (cteCap cte) = capASID (cteCap ctea) \<and> cap_asid_base' (cteCap cte) = cap_asid_base' (cteCap ctea) \<and> cap_vptr' (cteCap cte) = cap_vptr' (cteCap ctea)) rv s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>ctea. untyped_derived_eq (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap cte))) (cteCap ctea)) rv s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<and> rv \<noteq> destSlot \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s))) \<and> (gen_invocation_type label = CNodeMove \<longrightarrow> cte_wp_at' (\<lambda>c. weak_derived' (cteCap cte) (cteCap c)) rv s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = cteCap cte) rv s \<and> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) rv s \<and> valid_cap' (cteCap cte) s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s) \<and> (gen_invocation_type label = CNodeMutate \<longrightarrow> (\<forall>x. (\<exists>xa. args' = x # xa) \<longrightarrow> global.updateCapData True x (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True x (cteCap cte)) (cteCap c)) rv s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True x (cteCap cte)) rv s \<and> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) rv s \<and> valid_cap' (global.updateCapData True x (cteCap cte)) s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s))))
 2. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace> ensureEmptySlot destSlot \<lbrace>\<lambda>y s. True \<and> True \<and> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) destSlot and ex_cte_cap_wp_to' (\<lambda>_. True) destSlot) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 8. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 10. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot rv s cte ctea. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke; invs' s; gen_invocation_type label \<noteq> CNodeDelete; ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s; gen_invocation_type label \<noteq> CNodeCancelBadgedSends; ctes_of s destSlot = Some cte; cteCap cte = capability.NullCap; gen_invocation_type label \<noteq> CNodeRotate; gen_invocation_type label \<noteq> CNodeSaveCaller; ctes_of s rv = Some ctea; cteCap ctea \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> (gen_invocation_type label = CNodeCopy \<longrightarrow> (\<forall>x. (\<exists>xa. args' = x # xa) \<longrightarrow> valid_cap' (cteCap ctea) s \<and> valid_objs' s \<and> untyped_derived_eq (global.maskCapRights (rightsFromWord x) (cteCap ctea)) (cteCap ctea) \<and> rv \<noteq> destSlot)) \<and> (gen_invocation_type label = CNodeMint \<longrightarrow> (\<forall>x xa. args' = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap ctea)) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap ctea))) s \<and> badge_derived' (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap ctea))) (cteCap ctea) \<and> valid_objs' s \<and> untyped_derived_eq (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap ctea))) (cteCap ctea) \<and> rv \<noteq> destSlot))) \<and> (gen_invocation_type label = CNodeMove \<longrightarrow> valid_cap' (cteCap ctea) s) \<and> (gen_invocation_type label = CNodeMutate \<longrightarrow> (\<forall>x. (\<exists>xa. args' = x # xa) \<longrightarrow> global.updateCapData True x (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> weak_derived' (global.updateCapData True x (cteCap ctea)) (cteCap ctea) \<and> (isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = global.updateCapData True x (cteCap ctea)) \<and> valid_cap' (global.updateCapData True x (cteCap ctea)) s))
 2. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace> ensureEmptySlot destSlot \<lbrace>\<lambda>y s. True \<and> True \<and> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) destSlot and ex_cte_cap_wp_to' (\<lambda>_. True) destSlot) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 8. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 10. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot rv s cte ctea. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke; invs' s; gen_invocation_type label \<noteq> CNodeDelete; ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s; gen_invocation_type label \<noteq> CNodeCancelBadgedSends; ctes_of s destSlot = Some cte; cteCap cte = capability.NullCap; gen_invocation_type label \<noteq> CNodeRotate; gen_invocation_type label \<noteq> CNodeSaveCaller; ctes_of s rv = Some ctea; cteCap ctea \<noteq> capability.NullCap; valid_objs' s\<rbrakk> \<Longrightarrow> (gen_invocation_type label = CNodeCopy \<longrightarrow> (\<forall>x. (\<exists>xa. args' = x # xa) \<longrightarrow> valid_cap' (cteCap ctea) s \<and> valid_objs' s \<and> untyped_derived_eq (global.maskCapRights (rightsFromWord x) (cteCap ctea)) (cteCap ctea) \<and> rv \<noteq> destSlot)) \<and> (gen_invocation_type label = CNodeMint \<longrightarrow> (\<forall>x xa. args' = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap ctea)) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap ctea))) s \<and> badge_derived' (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap ctea))) (cteCap ctea) \<and> valid_objs' s \<and> untyped_derived_eq (global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap ctea))) (cteCap ctea) \<and> rv \<noteq> destSlot))) \<and> (gen_invocation_type label = CNodeMove \<longrightarrow> valid_cap' (cteCap ctea) s) \<and> (gen_invocation_type label = CNodeMutate \<longrightarrow> (\<forall>x. (\<exists>xa. args' = x # xa) \<longrightarrow> global.updateCapData True x (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> weak_derived' (global.updateCapData True x (cteCap ctea)) (cteCap ctea) \<and> (isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = global.updateCapData True x (cteCap ctea)) \<and> valid_cap' (global.updateCapData True x (cteCap ctea)) s))
 2. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace> ensureEmptySlot destSlot \<lbrace>\<lambda>y s. True \<and> True \<and> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) destSlot and ex_cte_cap_wp_to' (\<lambda>_. True) destSlot) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 8. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 10. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot rv s cte ctea. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke; invs' s; gen_invocation_type label \<noteq> CNodeDelete; ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s; gen_invocation_type label \<noteq> CNodeCancelBadgedSends; ctes_of s destSlot = Some cte; cteCap cte = capability.NullCap; gen_invocation_type label \<noteq> CNodeRotate; gen_invocation_type label \<noteq> CNodeSaveCaller; ctes_of s rv = Some ctea; cteCap ctea \<noteq> capability.NullCap; valid_objs' s\<rbrakk> \<Longrightarrow> (gen_invocation_type label = CNodeCopy \<longrightarrow> (\<exists>x xa. args' = x # xa) \<longrightarrow> rv \<noteq> destSlot) \<and> (gen_invocation_type label = CNodeMint \<longrightarrow> (\<forall>x xa. args' = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> global.updateCapData False xb (global.maskCapRights (rightsFromWord x) (cteCap ctea)) \<noteq> capability.NullCap \<longrightarrow> rv \<noteq> destSlot))) \<and> (gen_invocation_type label = CNodeMutate \<longrightarrow> (\<forall>x. (\<exists>xa. args' = x # xa) \<longrightarrow> global.updateCapData True x (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = global.updateCapData True x (cteCap ctea)))
 2. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace> ensureEmptySlot destSlot \<lbrace>\<lambda>y s. True \<and> True \<and> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) destSlot and ex_cte_cap_wp_to' (\<lambda>_. True) destSlot) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 8. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 10. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>index bits src_index src_depth args' src_root_cap exs' destSlot. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs' destSlot\<rbrace> ensureEmptySlot destSlot \<lbrace>\<lambda>y s. True \<and> True \<and> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) destSlot and ex_cte_cap_wp_to' (\<lambda>_. True) destSlot) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits src_index src_depth args' src_root_cap exs'. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'39 index bits src_index src_depth args' src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B43 index bits src_index src_depth args' src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args' src_root_cap exs' s. \<lbrakk>args = index # bits # src_index # src_depth # args'; cs = src_root_cap # exs'; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<noteq> CNodeRevoke \<and> gen_invocation_type label \<noteq> CNodeDelete \<and> gen_invocation_type label \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label \<noteq> CNodeRotate \<and> gen_invocation_type label \<noteq> CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'39 index bits src_index src_depth args' src_root_cap exs' s
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 9. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label (index # bits # args') (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
returnOk (Revoke destSlot)
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke\<rbrakk> \<Longrightarrow> \<lbrace>?P'531 index bits args'\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
returnOk (Revoke destSlot)
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) s\<rbrakk> \<Longrightarrow> ?P'531 index bits args' s
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRevoke; invs' s \<and> valid_cap' (capability.CNodeCap w n w2 n2) s \<and> (\<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) \<and> (\<forall>cap\<in>set cs. valid_cap' cap s) \<and> (\<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
returnOk (Delete destSlot)
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete\<rbrakk> \<Longrightarrow> \<lbrace>?P'547 index bits args'\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
returnOk (Delete destSlot)
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) s\<rbrakk> \<Longrightarrow> ?P'547 index bits args' s
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeDelete; invs' s \<and> valid_cap' (capability.CNodeCap w n w2 n2) s \<and> (\<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) \<and> (\<forall>cap\<in>set cs. valid_cap' cap s) \<and> (\<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
y <- ensureEmptySlot destSlot;
returnOk (SaveCaller destSlot)
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>?P'563 index bits args'\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
y <- ensureEmptySlot destSlot;
returnOk (SaveCaller destSlot)
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeSaveCaller; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) s\<rbrakk> \<Longrightarrow> ?P'563 index bits args' s
 3. \<And>index bits args'. \<lbrakk>args = index # bits # args'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label (index # bits # args') (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
cte <- liftE (getCTE destSlot);
y <- whenE (\<not> hasCancelSendRights (cteCap cte)) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (CancelBadgedSends (cteCap cte))
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>?P'585 index bits args'\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
cte <- liftE (getCTE destSlot);
y <- whenE (\<not> hasCancelSendRights (cteCap cte)) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (CancelBadgedSends (cteCap cte))
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) s\<rbrakk> \<Longrightarrow> ?P'585 index bits args' s
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>?P'601 index bits args'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rv s \<and> (hasCancelSendRights (cteCap cte) \<longrightarrow> valid_cap' (cteCap cte) s))\<rbrace>, -
 2. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> ?P'601 index bits args' s
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits args'. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> \<lbrace>?P'601 index bits args'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>\<lambda>rv s. invs' s \<and> cte_wp_at' (\<lambda>_. True) rv s\<rbrace>, -
 2. \<And>index bits args' rv s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends; invs' s \<and> cte_wp_at' (\<lambda>_. True) rv s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rv s \<and> (hasCancelSendRights (cteCap cte) \<longrightarrow> valid_cap' (cteCap cte) s))
 3. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> ?P'601 index bits args' s
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>index bits args' rv s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends; invs' s \<and> cte_wp_at' (\<lambda>_. True) rv s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rv s \<and> (hasCancelSendRights (cteCap cte) \<longrightarrow> valid_cap' (cteCap cte) s))
 2. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> invs' s \<and> (valid_objs' and valid_cap' (capability.CNodeCap w n w2 n2)) s
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>index bits args' rv s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends; invs' s \<and> (\<exists>cte. ctes_of s rv = Some cte)\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s rv = Some cte \<and> (hasCancelSendRights (cteCap cte) \<longrightarrow> valid_cap' (cteCap cte) s)
 2. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> invs' s \<and> (valid_objs' and valid_cap' (capability.CNodeCap w n w2 n2)) s
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>index bits args' s. \<lbrakk>args = index # bits # args'; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeCancelBadgedSends; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> invs' s \<and> (valid_objs' and valid_cap' (capability.CNodeCap w n w2 n2)) s
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' pivot_root_cap s \<and> valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
srcSlot <- lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth);
pivotSlot <- lookupSlotForCNodeOp True pivot_root_cap pivot_index (unat pivot_depth);
y <- whenE (pivotSlot = srcSlot \<or> pivotSlot = destSlot) (throwError Fault_H.syscall_error.IllegalOperation);
y <- if srcSlot = destSlot then returnOk () else ensureEmptySlot destSlot;
srcCap <- liftE (liftM cteCap (getCTE srcSlot));
y <- whenE (srcCap = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth))));
pivotCap <- liftE (liftM cteCap (getCTE pivotSlot));
y <- whenE (pivotCap = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat pivot_depth))));
y <- whenE (global.updateCapData True src_new_data srcCap = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
y <- whenE (global.updateCapData True pivot_new_data pivotCap = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (Rotate (global.updateCapData True src_new_data srcCap) (global.updateCapData True pivot_new_data pivotCap) srcSlot pivotSlot destSlot)
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
srcSlot <- lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth);
pivotSlot <- lookupSlotForCNodeOp True pivot_root_cap pivot_index (unat pivot_depth);
y <- whenE (pivotSlot = srcSlot \<or> pivotSlot = destSlot) (throwError Fault_H.syscall_error.IllegalOperation);
y <- if srcSlot = destSlot then returnOk () else ensureEmptySlot destSlot;
srcCap <- liftE (liftM cteCap (getCTE srcSlot));
y <- whenE (srcCap = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup True (Fault_H.lookup_failure.MissingCapability (unat src_depth))));
pivotCap <- liftE (liftM cteCap (getCTE pivotSlot));
y <- whenE (pivotCap = capability.NullCap) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat pivot_depth))));
y <- whenE (global.updateCapData True src_new_data srcCap = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
y <- whenE (global.updateCapData True pivot_new_data pivotCap = capability.NullCap) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (Rotate (global.updateCapData True src_new_data srcCap) (global.updateCapData True pivot_new_data pivotCap) srcSlot pivotSlot destSlot)
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' pivot_root_cap s \<and> valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 3. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'657 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot\<rbrace> lookupSlotForCNodeOp True pivot_root_cap pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivotSlot s. pivotSlot \<noteq> srcSlot \<and> pivotSlot \<noteq> destSlot \<longrightarrow> (srcSlot = destSlot \<longrightarrow> cte_wp_at' (\<lambda>_. True) destSlot s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) destSlot s \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>_. True) pivotSlot s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) pivotSlot s \<and> (cteCap ctea \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData True src_new_data (cteCap cte)) s \<and> valid_cap' (global.updateCapData True pivot_new_data (cteCap ctea)) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True src_new_data (cteCap cte)) (cteCap c)) destSlot s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True src_new_data (cteCap cte)) destSlot s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True pivot_new_data (cteCap ctea)) (cteCap c)) pivotSlot s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True pivot_new_data (cteCap ctea)) pivotSlot s \<and> destSlot \<noteq> pivotSlot \<and> ex_cte_cap_wp_to' (\<lambda>_. True) pivotSlot s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s))))) \<and> (srcSlot \<noteq> destSlot \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) srcSlot s \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>_. True) pivotSlot s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) pivotSlot s \<and> (cteCap ctea \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData True src_new_data (cteCap cte)) s \<and> valid_cap' (global.updateCapData True pivot_new_data (cteCap ctea)) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True src_new_data (cteCap cte)) (cteCap c)) srcSlot s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True src_new_data (cteCap cte)) srcSlot s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True pivot_new_data (cteCap ctea)) (cteCap c)) pivotSlot s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True pivot_new_data (cteCap ctea)) pivotSlot s \<and> srcSlot \<noteq> pivotSlot \<and> ex_cte_cap_wp_to' (\<lambda>_. True) pivotSlot s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s)))))\<rbrace>, -
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>\<lambda>srcSlot s. True \<and> ?P'657 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' pivot_root_cap s \<and> valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 5. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'657 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot\<rbrace> lookupSlotForCNodeOp True pivot_root_cap pivot_index (unat pivot_depth) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) rv s \<and> cte_wp_at' (\<lambda>_. True) destSlot s \<and> cte_wp_at' (\<lambda>_. True) srcSlot s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s \<and> invs' s\<rbrace>, -
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot rv s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; cte_wp_at' (\<lambda>_. True) rv s \<and> cte_wp_at' (\<lambda>_. True) destSlot s \<and> cte_wp_at' (\<lambda>_. True) srcSlot s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s \<and> invs' s\<rbrakk> \<Longrightarrow> rv \<noteq> srcSlot \<and> rv \<noteq> destSlot \<longrightarrow> (srcSlot = destSlot \<longrightarrow> cte_wp_at' (\<lambda>_. True) destSlot s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) destSlot s \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) rv s \<and> (cteCap ctea \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData True src_new_data (cteCap cte)) s \<and> valid_cap' (global.updateCapData True pivot_new_data (cteCap ctea)) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True src_new_data (cteCap cte)) (cteCap c)) destSlot s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True src_new_data (cteCap cte)) destSlot s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True pivot_new_data (cteCap ctea)) (cteCap c)) rv s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True pivot_new_data (cteCap ctea)) rv s \<and> destSlot \<noteq> rv \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s))))) \<and> (srcSlot \<noteq> destSlot \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) srcSlot s \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) rv s \<and> (cteCap ctea \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData True src_new_data (cteCap cte)) s \<and> valid_cap' (global.updateCapData True pivot_new_data (cteCap ctea)) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True src_new_data (cteCap cte)) (cteCap c)) srcSlot s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True src_new_data (cteCap cte)) srcSlot s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True pivot_new_data (cteCap ctea)) (cteCap c)) rv s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True pivot_new_data (cteCap ctea)) rv s \<and> srcSlot \<noteq> rv \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s)))))
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>\<lambda>srcSlot s. True \<and> ?P'657 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' pivot_root_cap s \<and> valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 6. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot rv s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; cte_wp_at' (\<lambda>_. True) rv s \<and> cte_wp_at' (\<lambda>_. True) destSlot s \<and> cte_wp_at' (\<lambda>_. True) srcSlot s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s \<and> invs' s\<rbrakk> \<Longrightarrow> rv \<noteq> srcSlot \<and> rv \<noteq> destSlot \<longrightarrow> (srcSlot = destSlot \<longrightarrow> cte_wp_at' (\<lambda>_. True) destSlot s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) destSlot s \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) rv s \<and> (cteCap ctea \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData True src_new_data (cteCap cte)) s \<and> valid_cap' (global.updateCapData True pivot_new_data (cteCap ctea)) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True src_new_data (cteCap cte)) (cteCap c)) destSlot s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True src_new_data (cteCap cte)) destSlot s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True pivot_new_data (cteCap ctea)) (cteCap c)) rv s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True pivot_new_data (cteCap ctea)) rv s \<and> destSlot \<noteq> rv \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s))))) \<and> (srcSlot \<noteq> destSlot \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) destSlot s \<longrightarrow> cte_wp_at' (\<lambda>_. True) srcSlot s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) srcSlot s \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>_. True) rv s \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) rv s \<and> (cteCap ctea \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData True src_new_data (cteCap cte)) s \<and> valid_cap' (global.updateCapData True pivot_new_data (cteCap ctea)) s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True src_new_data (cteCap cte)) (cteCap c)) srcSlot s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True src_new_data (cteCap cte)) srcSlot s \<and> cte_wp_at' (\<lambda>c. weak_derived' (global.updateCapData True pivot_new_data (cteCap ctea)) (cteCap c)) rv s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c) \<longrightarrow> cteCap c = global.updateCapData True pivot_new_data (cteCap ctea)) rv s \<and> srcSlot \<noteq> rv \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s)))))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>\<lambda>srcSlot s. True \<and> (valid_objs' and valid_cap' pivot_root_cap) s \<and> cte_wp_at' (\<lambda>_. True) destSlot s \<and> cte_wp_at' (\<lambda>_. True) srcSlot s \<and> (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s \<and> invs' s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' pivot_root_cap s \<and> valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 5. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot rv s cte ctea cteb. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; ctes_of s rv = Some cte; ctes_of s destSlot = Some ctea; ctes_of s srcSlot = Some cteb; ex_cte_cap_wp_to' (\<lambda>_. True) rv s; ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s; invs' s; rv \<noteq> srcSlot; rv \<noteq> destSlot\<rbrakk> \<Longrightarrow> (srcSlot = destSlot \<longrightarrow> cteCap ctea \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData True src_new_data (cteCap ctea)) s \<and> valid_cap' (global.updateCapData True pivot_new_data (cteCap cte)) s \<and> weak_derived' (global.updateCapData True src_new_data (cteCap ctea)) (cteCap ctea) \<and> (isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = global.updateCapData True src_new_data (cteCap ctea)) \<and> weak_derived' (global.updateCapData True pivot_new_data (cteCap cte)) (cteCap cte) \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = global.updateCapData True pivot_new_data (cteCap cte))) \<and> (srcSlot \<noteq> destSlot \<longrightarrow> cteCap ctea = capability.NullCap \<longrightarrow> cteCap cteb \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap cteb) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData True src_new_data (cteCap cteb)) s \<and> valid_cap' (global.updateCapData True pivot_new_data (cteCap cte)) s \<and> weak_derived' (global.updateCapData True src_new_data (cteCap cteb)) (cteCap cteb) \<and> (isUntypedCap (cteCap cteb) \<longrightarrow> cteCap cteb = global.updateCapData True src_new_data (cteCap cteb)) \<and> weak_derived' (global.updateCapData True pivot_new_data (cteCap cte)) (cteCap cte) \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = global.updateCapData True pivot_new_data (cteCap cte)))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>\<lambda>srcSlot s. True \<and> (valid_objs' and valid_cap' pivot_root_cap) s \<and> cte_wp_at' (\<lambda>_. True) destSlot s \<and> cte_wp_at' (\<lambda>_. True) srcSlot s \<and> (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s \<and> invs' s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' pivot_root_cap s \<and> valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 5. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot rv s cte ctea cteb. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; ctes_of s rv = Some cte; ctes_of s destSlot = Some ctea; ctes_of s srcSlot = Some cteb; ex_cte_cap_wp_to' (\<lambda>_. True) rv s; ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s; invs' s; rv \<noteq> srcSlot; rv \<noteq> destSlot; valid_objs' s\<rbrakk> \<Longrightarrow> (srcSlot = destSlot \<longrightarrow> cteCap ctea \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData True src_new_data (cteCap ctea)) s \<and> valid_cap' (global.updateCapData True pivot_new_data (cteCap cte)) s \<and> weak_derived' (global.updateCapData True src_new_data (cteCap ctea)) (cteCap ctea) \<and> (isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = global.updateCapData True src_new_data (cteCap ctea)) \<and> weak_derived' (global.updateCapData True pivot_new_data (cteCap cte)) (cteCap cte) \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = global.updateCapData True pivot_new_data (cteCap cte))) \<and> (srcSlot \<noteq> destSlot \<longrightarrow> cteCap ctea = capability.NullCap \<longrightarrow> cteCap cteb \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap cteb) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> valid_cap' (global.updateCapData True src_new_data (cteCap cteb)) s \<and> valid_cap' (global.updateCapData True pivot_new_data (cteCap cte)) s \<and> weak_derived' (global.updateCapData True src_new_data (cteCap cteb)) (cteCap cteb) \<and> (isUntypedCap (cteCap cteb) \<longrightarrow> cteCap cteb = global.updateCapData True src_new_data (cteCap cteb)) \<and> weak_derived' (global.updateCapData True pivot_new_data (cteCap cte)) (cteCap cte) \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = global.updateCapData True pivot_new_data (cteCap cte)))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>\<lambda>srcSlot s. True \<and> (valid_objs' and valid_cap' pivot_root_cap) s \<and> cte_wp_at' (\<lambda>_. True) destSlot s \<and> cte_wp_at' (\<lambda>_. True) srcSlot s \<and> (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s \<and> invs' s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' pivot_root_cap s \<and> valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 5. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot srcSlot rv s cte ctea cteb. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; ctes_of s rv = Some cte; ctes_of s destSlot = Some ctea; ctes_of s srcSlot = Some cteb; ex_cte_cap_wp_to' (\<lambda>_. True) rv s; ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s; invs' s; rv \<noteq> srcSlot; rv \<noteq> destSlot; valid_objs' s\<rbrakk> \<Longrightarrow> (srcSlot = destSlot \<longrightarrow> cteCap ctea \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap ctea) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> (isUntypedCap (cteCap ctea) \<longrightarrow> cteCap ctea = global.updateCapData True src_new_data (cteCap ctea)) \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = global.updateCapData True pivot_new_data (cteCap cte))) \<and> (srcSlot \<noteq> destSlot \<longrightarrow> cteCap ctea = capability.NullCap \<longrightarrow> cteCap cteb \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True src_new_data (cteCap cteb) \<noteq> capability.NullCap \<longrightarrow> global.updateCapData True pivot_new_data (cteCap cte) \<noteq> capability.NullCap \<longrightarrow> (isUntypedCap (cteCap cteb) \<longrightarrow> cteCap cteb = global.updateCapData True src_new_data (cteCap cteb)) \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = global.updateCapData True pivot_new_data (cteCap cte)))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>\<lambda>srcSlot s. True \<and> (valid_objs' and valid_cap' pivot_root_cap) s \<and> cte_wp_at' (\<lambda>_. True) destSlot s \<and> cte_wp_at' (\<lambda>_. True) srcSlot s \<and> (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s \<and> invs' s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' pivot_root_cap s \<and> valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 5. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' destSlot\<rbrace> lookupSlotForCNodeOp True src_root_cap src_index (unat src_depth) \<lbrace>\<lambda>srcSlot s. True \<and> (valid_objs' and valid_cap' pivot_root_cap) s \<and> cte_wp_at' (\<lambda>_. True) destSlot s \<and> cte_wp_at' (\<lambda>_. True) srcSlot s \<and> (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> ex_cte_cap_wp_to' (\<lambda>_. True) destSlot s \<and> invs' s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate\<rbrakk> \<Longrightarrow> \<lbrace>?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace> lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits) \<lbrace>?B621 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' pivot_root_cap s \<and> valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> ?P'617 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s
 4. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args' pivot_root_cap src_root_cap exs' s. \<lbrakk>args = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'; cs = pivot_root_cap # src_root_cap # exs'; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label = CNodeRotate; (invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. valid_cap' pivot_root_cap s \<and> valid_cap' src_root_cap s \<and> (\<forall>cap\<in>set exs'. valid_cap' cap s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' src_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set exs'. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> True \<and> (valid_objs' and valid_cap' pivot_root_cap) s \<and> (valid_objs' and valid_cap' (capability.CNodeCap w n w2 n2)) s \<and> (valid_objs' and valid_cap' src_root_cap) s \<and> (\<forall>r\<in>cte_refs' pivot_root_cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> invs' s
 2. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args = [] \<or> (\<exists>x. args = [x]) \<or> (\<exists>index bits args'. args = index # bits # args' \<and> gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label = CNodeRotate \<and> (case (args', cs) of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))) \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>cte_refs' (capability.CNodeCap w n w2 n2) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeCNodeInvocation label args (capability.CNodeCap w n w2 n2) cs \<lbrace>valid_cnode_inv'\<rbrace>, - proof (prove)
goal (14 subgoals):
 1. gen_invocation_type label \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<Longrightarrow> (args = [] \<longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_cnode_inv'\<rbrace>, -) \<and> (\<forall>x21 x22. (x22 = [] \<longrightarrow> args = [x21] \<longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_cnode_inv'\<rbrace>, -) \<and> (\<forall>x21a x22a. x22 = x21a # x22a \<longrightarrow> args = x21 # x21a # x22a \<longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_cnode_inv'\<rbrace>, -))
 2. args = [] \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_cnode_inv'\<rbrace>, -
 3. \<And>x. args = [x] \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller] then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_cnode_inv'\<rbrace>, -
 4. \<And>index bits args'. \<lbrakk>args = [index, bits]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; args' = []; gen_invocation_type label \<noteq> CNodeRevoke; gen_invocation_type label \<noteq> CNodeDelete; gen_invocation_type label \<noteq> CNodeCancelBadgedSends; gen_invocation_type label \<noteq> CNodeRotate; gen_invocation_type label \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
throwError Fault_H.syscall_error.TruncatedMessage
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 5. \<And>index bits args' x21 x22. \<lbrakk>args = [index, bits, x21]; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<noteq> CNodeRevoke; gen_invocation_type label \<noteq> CNodeDelete; gen_invocation_type label \<noteq> CNodeCancelBadgedSends; gen_invocation_type label \<noteq> CNodeRotate; gen_invocation_type label \<noteq> CNodeSaveCaller; args' = [x21]; x22 = []\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
throwError Fault_H.syscall_error.TruncatedMessage
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 6. \<And>index bits args' x21 x22 x21a x22a. \<lbrakk>args = index # bits # x21 # x21a # x22a; gen_invocation_type label \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label \<noteq> CNodeRevoke; gen_invocation_type label \<noteq> CNodeDelete; gen_invocation_type label \<noteq> CNodeCancelBadgedSends; gen_invocation_type label \<noteq> CNodeRotate; gen_invocation_type label \<noteq> CNodeSaveCaller; args' = x21 # x21a # x22a; x22 = x21a # x22a; cs = []\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
throwError Fault_H.syscall_error.TruncatedMessage
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 7. \<And>index bits args'. \<lbrakk>args = [index, bits]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label = CNodeRotate; args' = []\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
throwError Fault_H.syscall_error.TruncatedMessage
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 8. \<And>index bits args' x21 x22. \<lbrakk>args = [index, bits, x21]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label = CNodeRotate; args' = [x21]; x22 = []\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
throwError Fault_H.syscall_error.TruncatedMessage
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 9. \<And>index bits args' x21 x22 x21a x22a. \<lbrakk>args = [index, bits, x21, x21a]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label = CNodeRotate; args' = [x21, x21a]; x22 = [x21a]; x22a = []\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
throwError Fault_H.syscall_error.TruncatedMessage
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
 10. \<And>index bits args' x21 x22 x21a x22a x21b x22b. \<lbrakk>args = [index, bits, x21, x21a, x21b]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label = CNodeRotate; args' = [x21, x21a, x21b]; x22 = [x21a, x21b]; x22a = [x21b]; x22b = []\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.CNodeCap w n w2 n2) and (\<lambda>s. \<forall>r\<in>{0..2 ^ n - 1}. ex_cte_cap_wp_to' (\<lambda>_. True) (w + r * 2 ^ cteSizeBits) s) and (\<lambda>s. \<forall>cap\<in>set cs. valid_cap' cap s) and (\<lambda>s. \<forall>cap\<in>set cs. \<forall>r\<in>cte_refs' cap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE destSlot <- lookupSlotForCNodeOp False (capability.CNodeCap w n w2 n2) index (unat bits);
throwError Fault_H.syscall_error.TruncatedMessage
odE \<lbrace>valid_cnode_inv'\<rbrace>, -
A total of 14 subgoals...