theory CNode_DR

lemma decode_cnode_corres:
  notes defns = transform_intent_def unlessE_whenE
                CNode_D.decode_cnode_invocation_def
                Decode_A.decode_cnode_invocation_def
                transform_intent_cnode_copy_def
                transform_intent_cnode_move_def
                transform_intent_cnode_mutate_def
                transform_intent_cnode_mint_def
                transform_intent_cnode_rotate_def
                transform_cap_list_def get_index_def
                throw_on_none_def
                transform_cnode_index_and_depth_def
                gen_invocation_type_eq and
         splits = gen_invocation_labels.split_asm invocation_label.split_asm
                  arch_invocation_label.split_asm list.split_asm
  shows
  "\<lbrakk> Some (CNodeIntent ui) = transform_intent (invocation_type label') args';
     cap = transform_cap cap';
     cap' = Structures_A.CNodeCap word n x;
     slot = transform_cslot_ptr slot';
     excaps = transform_cap_list  excaps' \<rbrakk> \<Longrightarrow>
   dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) \<top>
     (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. valid_cap (fst e) s) and valid_etcbs)
     (CNode_D.decode_cnode_invocation cap slot excaps ui)
     (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))" apply (drule_tac s="Some x" for x in sym) apply (rule_tac label=label' and args=args' and exs="map fst excaps'"
              in decode_cnode_cases2) apply (clarsimp simp: defns split: splits) apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres) apply simp apply simp apply simp apply (rule refl) apply (rule corres_splitEE) apply simp apply (rule dcorres_ensure_empty) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres, simp_all)[1] apply (simp add:liftE_bindE) apply (rule corres_split) apply (rule get_cap_corres, rule refl) apply (rule_tac R="src_capa = cap.NullCap" in corres_cases [where P=\<top> and P'=\<top>]) apply (simp add: update_cap_rights_def) apply simp apply (rule corres_splitEE) apply (rule derive_cap_dcorres) apply (simp add: mask_cap_def) apply (rule corres_splitEE[where r'=dc]) apply (rule corres_whenE, simp) apply (rule dcorres_throw) apply simp apply (rule dcorres_returnOk) apply (simp add: translate_cnode_invocation_def) apply ((wp hoare_drop_imps get_cap_wellformed lsfco_not_idle|simp)+) apply (subgoal_tac "valid_mdb s") prefer 2 apply fastforce apply (fastforce simp: valid_mdb_def mdb_cte_at_def)
          \<comment> \<open>Mint\<close> apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres; simp) apply simp apply (rule corres_splitEE[OF dcorres_ensure_empty]) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres; simp) apply (simp add:liftE_bindE) apply (rule corres_split) apply (rule get_cap_corres; simp) apply (rule_tac R="src_capa = cap.NullCap"
                             in corres_cases [where P=\<top> and P'=\<top>]) apply (simp add:update_cap_rights_def CSpace_D.update_cap_data_def) apply simp apply (rule dcorres_update_cap_data_bind[where P = \<top>]) apply (simp add:mask_cap_def) apply (rule corres_splitEE[where Q = \<top> and R = "\<lambda>r. \<top>", simplified]) apply (rule derive_cap_dcorres; simp) apply (rule corres_splitEE[where r' = dc and Q = \<top>,simplified]) apply (rule corres_whenE[where P = \<top>,simplified]) apply simp apply (rule dcorres_throw) apply simp apply (rule dcorres_returnOk) apply (simp add:translate_cnode_invocation_def) apply wp+ apply (rule hoare_post_imp_R[OF validE_validE_R]) apply (rule hoareE_TrueI[where P = \<top>]) apply (wp|simp)+ apply (strengthen mask_cap_valid) apply (wp lsfco_not_idle hoareE_TrueI[where P = \<top>] |simp)+ apply (subgoal_tac "valid_mdb s") apply (fastforce simp: valid_mdb_def mdb_cte_at_def) apply fastforce

         \<comment> \<open>Move\<close> apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres) apply simp apply simp apply simp apply (rule refl) apply (rule corres_splitEE) apply simp apply (rule dcorres_ensure_empty) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres, simp_all)[1] apply (simp add:liftE_bindE) apply (rule corres_split) apply (rule get_cap_corres, rule refl) apply (rule_tac R="src_capa = cap.NullCap" in corres_cases [where P=\<top> and P'=\<top>]) apply simp apply simp apply (rule_tac P="\<top>" and P'="K (wellformed_cap src_capa)" in corres_returnOk) apply (simp add: translate_cnode_invocation_def all_rights_def) apply ((wp hoare_drop_imps get_cap_wellformed lsfco_not_idle|simp)+) apply fastforce

        \<comment> \<open>Mutate\<close> apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres; simp) apply simp apply (rule corres_splitEE[OF dcorres_ensure_empty]) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres; simp) apply (simp add:liftE_bindE) apply (rule corres_split) apply (rule get_cap_corres; simp) apply (rule_tac R="src_capa = cap.NullCap" in corres_cases [where P=\<top> and P'=\<top>]) apply (simp add:update_cap_rights_def
                       CSpace_D.update_cap_data_def) apply simp apply (rule_tac F="wellformed_cap src_capa" in corres_gen_asm2) apply (simp add: all_rights_def) apply (rule dcorres_update_cap_data_bind) apply (simp) apply (rule whenE_throwError_corres_initial) apply simp apply simp apply (rule dcorres_returnOk) apply (simp add:translate_cnode_invocation_def) apply simp apply (wp get_cap_wellformed
                  lsfco_not_idle hoareE_TrueI[where P = \<top>] | simp)+ apply (subgoal_tac "valid_mdb s") apply (fastforce simp: valid_mdb_def mdb_cte_at_def) apply fastforce

      \<comment> \<open>Revoke\<close> apply (clarsimp simp: defns split: splits) apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres, simp_all)[1] apply (rule dcorres_returnOk) apply (simp add: translate_cnode_invocation_def) apply wp apply wp apply simp apply fastforce apply (clarsimp simp: defns split: splits) apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres, simp_all)[1] apply (rule dcorres_returnOk) apply (simp add: translate_cnode_invocation_def) apply (wp+)[2] apply simp apply fastforce apply (clarsimp simp: defns split: splits) apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres, simp_all)[1] apply (rule corres_splitEE) apply simp apply (rule dcorres_ensure_empty) apply (rule dcorres_returnOk) apply (simp add: translate_cnode_invocation_def) apply (wp lsfco_not_idle)+ apply simp apply fastforce apply (clarsimp simp: defns split: splits) apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres, simp_all)[1] apply (simp add: liftE_bindE) apply (rule corres_split) apply (rule get_cap_corres, rule refl) apply (rule corres_splitEE) apply (rule corres_whenE [where r=dc]) apply simp apply (rule dcorres_throw) apply simp apply (rule dcorres_returnOk) apply (simp add: translate_cnode_invocation_def) apply (wp lsfco_not_idle hoare_drop_imps|simp)+ apply fastforce apply (clarsimp simp: defns split: splits) apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres, simp_all)[1] apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres, simp_all)[1] apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres, simp_all)[1] apply (rule_tac P=\<top> and P'="real_cte_at pivot_slota and real_cte_at src_slota
                                       and real_cte_at dest_slota" in corres_splitEE) apply (rule corres_assume_pre) apply (rule corres_guard_imp) apply (rule corres_whenE [where r=dc]) apply (clarsimp simp: transform_cslot_ptr_inj_real_cte) apply (rule dcorres_throw) apply simp apply simp apply simp apply (rule_tac P=\<top> and
                             P'="real_cte_at src_slota and real_cte_at dest_slota
                                 and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs"
                             in corres_splitEE) apply (rule corres_assume_pre) apply (rule corres_guard_imp) apply (rule corres_whenE) apply (clarsimp simp: transform_cslot_ptr_inj_real_cte) apply simp apply (rule dcorres_ensure_empty) apply simp apply simp apply simp apply (simp add: liftE_bindE) apply (rule corres_split) apply (rule get_cap_corres, rule refl) apply (rule corres_splitEE) apply (rule corres_whenE [where r=dc], simp) apply (rule dcorres_throw) apply simp apply (rule corres_split) apply (rule get_cap_corres, rule refl) apply (rule corres_splitEE) apply (rule corres_whenE [where r=dc], simp) apply (rule dcorres_throw) apply simp apply (rule dcorres_update_cap_data_bind, simp) apply (rule dcorres_update_cap_data_bind, simp) apply (rule whenE_throwError_corres_initial) apply simp apply simp apply (rule whenE_throwError_corres_initial) apply simp apply simp apply (rule dcorres_returnOk) apply (simp add:translate_cnode_invocation_def) apply (wp get_cap_wp whenE_wp|clarsimp)+ apply (rule hoare_post_imp_R[OF validE_validE_R]) apply (rule hoareE_TrueI[where P = \<top>]) apply fastforce apply (wp hoare_drop_imp|simp)+ apply (rule_tac Q'="\<lambda>r. real_cte_at src_slota and valid_objs and
                                real_cte_at dest_slota and valid_idle and
                                     not_idle_thread (fst src_slota) and
                                     not_idle_thread (fst dest_slota) and
                                     not_idle_thread (fst r) and valid_etcbs"
                             in hoare_post_imp_R) apply (wp lsfco_not_idle) apply (clarsimp simp:Invariants_AI.cte_wp_valid_cap) apply (wp lsfco_not_idle)+ apply simp apply fastforce apply (erule disjE) apply (simp add: transform_intent_def upto_enum_def toEnum_def fromEnum_def
                    enum_gen_invocation_labels enum_invocation_label gen_invocation_type_eq
               split: gen_invocation_labels.splits invocation_label.splits arch_invocation_label.splits) apply (erule disjE) apply (simp add: defns split: splits) apply (erule disjE) apply (simp add: defns split: splits) apply clarsimp apply (erule disjE) apply clarsimp apply (case_tac args'a) apply clarsimp apply (simp add: upto_enum_def toEnum_def fromEnum_def
                     enum_invocation_label enum_gen_invocation_labels) apply (simp add: defns split: splits) apply clarsimp apply (case_tac list) apply clarsimp apply (simp add: defns split: splits) apply clarsimp apply (case_tac excaps', simp_all)[1] apply (clarsimp simp: Decode_A.decode_cnode_invocation_def unlessE_whenE) apply (simp add: upto_enum_def toEnum_def fromEnum_def
                    enum_invocation_label enum_gen_invocation_labels
               flip: gen_invocation_type_eq) apply (clarsimp simp: cnode_decode_throw transform_cap_list_def) apply (rule corres_bindE_throwError, wp, simp) apply (clarsimp simp: transform_intent_def transform_cnode_index_and_depth_def
                        transform_intent_cnode_rotate_def
                  simp flip: gen_invocation_type_eq
                  split: list.splits) apply (simp add: cnode_decode_rotate_throw transform_cap_list_def) apply (simp add: Decode_A.decode_cnode_invocation_def unlessE_whenE gen_invocation_type_eq) apply (rule corres_bindE_throwError, wp, simp) apply (simp add: cnode_decode_rotate_throw transform_cap_list_def) apply (simp add: Decode_A.decode_cnode_invocation_def unlessE_whenE gen_invocation_type_eq) apply (rule corres_bindE_throwError, wp, simp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (CNodeIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (7 subgoals):
 1. \<And>index bits src_index src_depth args'a src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # src_index # src_depth # args'a; map fst excaps' = src_root_cap # exs'; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (10 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 3. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q292 index bits src_index src_depth x21 x22 a aa b zs) (?Q'292 index bits src_index src_depth x21 x22 a aa b zs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ?Q292 index bits src_index src_depth x21 x22 a aa b zs s
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'292 index bits src_index src_depth x21 x22 a aa b zs s
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 5. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'296 index bits src_index src_depth x21 x22 a aa b zs) (?P296 index bits src_index src_depth x21 x22 a aa b zs) (?P'296 index bits src_index src_depth x21 x22 a aa b zs) (CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits)) (CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits))
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; ?r'296 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R296 index bits src_index src_depth x21 x22 a aa b zs dest_slot) (?R'296 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> (?P296 index bits src_index src_depth x21 x22 a aa b zs and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (?P'296 index bits src_index src_depth x21 x22 a aa b zs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 8. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> index = of_bl (to_bl index)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> length (to_bl index) = 32
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> cdl_cap.CNodeCap word (of_bl x) (length x) n = transform_cap (cap.CNodeCap word n x)
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> unat bits = unat bits
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R296 index bits src_index src_depth x21 x22 a aa b zs dest_slot) (?R'296 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> length (to_bl index) = 32
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> cdl_cap.CNodeCap word (of_bl x) (length x) n = transform_cap (cap.CNodeCap word n x)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> unat bits = unat bits
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R296 index bits src_index src_depth x21 x22 a aa b zs dest_slot) (?R'296 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 10. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> cdl_cap.CNodeCap word (of_bl x) (length x) n = transform_cap (cap.CNodeCap word n x)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> unat bits = unat bits
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R296 index bits src_index src_depth x21 x22 a aa b zs dest_slot) (?R'296 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 9. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> unat bits = unat bits
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R296 index bits src_index src_depth x21 x22 a aa b zs dest_slot) (?R'296 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 8. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R296 index bits src_index src_depth x21 x22 a aa b zs dest_slot) (?R'296 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 7. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota) (?P308 index bits src_index src_depth x21 x22 a aa b zs dest_slot) (?P'310 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (CSpace_D.ensure_empty dest_slot) (CSpaceAcc_A.ensure_empty dest_slota)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; ?r'307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y) (?R'307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya) (doE src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>?R307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>?R'307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. ?P308 index bits src_index src_depth x21 x22 a aa b zs dest_slot and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. ?P'310 index bits src_index src_depth x21 x22 a aa b zs dest_slota and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 10. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'307 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota) (?P308 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)) (?P'310 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (CSpace_D.ensure_empty (transform_cslot_ptr dest_slota)) (CSpaceAcc_A.ensure_empty dest_slota)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; ?r'307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y) (?R'307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya) (doE src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>?R307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>?R'307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. ?P308 index bits src_index src_depth x21 x22 a aa b zs dest_slot and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. ?P'310 index bits src_index src_depth x21 x22 a aa b zs dest_slota and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 10. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y) (?R'307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya) (doE src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>?R307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>?R'307 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 9. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
A total of 16 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya) (?P318 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y) (?P'320 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya) (CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth)) (CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth))
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya; ?r'317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya src_slot src_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya src_slot) (?R'317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya src_slota) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slota dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. ?P318 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. ?P'320 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya src_slot) (?R'317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya src_slota) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- CSpace_D.derive_cap src_slot (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slota dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R317 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)) (?R'317 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr src_slota);
doE cap <- CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE
od) (do src_cap <- CSpaceAcc_A.get_cap src_slota;
doE y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_cap);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slota dest_slota)
odE
od)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'317 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'296 index bits src_index src_depth x21 x22 a aa b zs) s
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
A total of 18 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> dcorres (?r'334 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota) (?P345 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)) (?P'341 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota) (KHeap_D.get_cap (transform_cslot_ptr src_slota)) (CSpaceAcc_A.get_cap src_slota)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; ?r'334 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R334 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap) (?R'334 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa) (doE cap <- CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slota dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>?R334 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>?R'334 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. ?P345 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. ?P'341 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R334 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap) (?R'334 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa) (doE cap <- CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slota dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>?R334 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>?R'334 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cap <- CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slota dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q355 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap) (?Q'356 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa) (doE cap <- CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slota dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q355 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'356 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q355 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap) (?Q'356 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa) (doE cap <- CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slota dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q355 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'356 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q355 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)) (?Q'356 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa) (doE cap <- CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa));
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE new_cap <- CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa);
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slota dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q355 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'356 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q296 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 20 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa) (?P368 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)) (?P'364 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa) (CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa))) (CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa))
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; ?r'357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv) (?R'357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv') (doE y <- whenE (rv = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall rv (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (rv' = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall rv' src_slota dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa)) \<lbrace>?R357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'362 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa\<rbrace> CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa) \<lbrace>?R'357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (?P368 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap and ?Q366 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap)\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (?P'364 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa and ?Q'362 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa) = transform_cap (mask_cap (data_to_rights x21) src_capa)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv) (?R'357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv') (doE y <- whenE (rv = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall rv (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (rv' = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall rv' src_slota dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa)) \<lbrace>?R357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'362 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa\<rbrace> CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa) \<lbrace>?R'357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ((\<lambda>a. True) and ?Q366 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap)\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P376 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) src_slota c) and ?Q'362 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv) (?R'357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv') (doE y <- whenE (rv = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall rv (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (rv' = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall rv' src_slota dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa)) \<lbrace>?R357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'362 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa\<rbrace> CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa) \<lbrace>?R'357 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ((\<lambda>a. True) and ?Q366 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap)\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P376 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) src_slota c) and ?Q'362 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q296 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 22 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P380 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv) (?P'382 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv') (whenE (rv = cdl_cap.NullCap) throw) (whenE (rv' = cap.NullCap) (throwError IllegalOperation))
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rva) (?R'379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rv'a) (returnOk (cdl_cnode_invocation.InsertCall rv (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.InsertCall rv' src_slota dest_slota))
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace> whenE (rv = cdl_cap.NullCap) throw \<lbrace>?R379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace> whenE (rv' = cap.NullCap) (throwError IllegalOperation) \<lbrace>?R'379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa)) \<lbrace>\<lambda>rv. ?P380 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv and ?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'362 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa\<rbrace> CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa) \<lbrace>\<lambda>rv'. ?P'382 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv' and ?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ((\<lambda>a. True) and ?Q366 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap)\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P376 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) src_slota c) and ?Q'362 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 25 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P390 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv) (?P'392 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv') throw (throwError IllegalOperation)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rva) (?R'379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rv'a) (returnOk (cdl_cnode_invocation.InsertCall rv (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.InsertCall rv' src_slota dest_slota))
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace> whenE (rv = cdl_cap.NullCap) throw \<lbrace>?R379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace> whenE (rv' = cap.NullCap) (throwError IllegalOperation) \<lbrace>?R'379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa)) \<lbrace>\<lambda>rv. (\<lambda>s. rv = cdl_cap.NullCap \<longrightarrow> ?P390 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv s) and ?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'362 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa\<rbrace> CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa) \<lbrace>\<lambda>rv'. (\<lambda>s. rv' = cap.NullCap \<longrightarrow> ?P'392 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv' s) and ?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ((\<lambda>a. True) and ?Q366 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap)\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P376 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) src_slota c) and ?Q'362 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rva) (?R'379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rv'a) (returnOk (cdl_cnode_invocation.InsertCall rv (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.InsertCall rv' src_slota dest_slota))
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace> whenE (rv = cdl_cap.NullCap) throw \<lbrace>?R379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace> whenE (rv' = cap.NullCap) (throwError IllegalOperation) \<lbrace>?R'379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa)) \<lbrace>\<lambda>rv. (\<lambda>s. rv = cdl_cap.NullCap \<longrightarrow> True) and ?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'362 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa\<rbrace> CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa) \<lbrace>\<lambda>rv'. (\<lambda>s. rv' = cap.NullCap \<longrightarrow> True) and ?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ((\<lambda>a. True) and ?Q366 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap)\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P376 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) src_slota c) and ?Q'362 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rva) (?R'379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rv'a) (returnOk (cdl_cnode_invocation.InsertCall rv (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.InsertCall rv' src_slota dest_slota))
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace> whenE (rv = cdl_cap.NullCap) throw \<lbrace>?R379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace> whenE (rv' = cap.NullCap) (throwError IllegalOperation) \<lbrace>?R'379 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa)) \<lbrace>\<lambda>rv. (\<lambda>s. rv = cdl_cap.NullCap \<longrightarrow> True) and ?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'362 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa\<rbrace> CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa) \<lbrace>\<lambda>rv'. (\<lambda>s. rv' = cap.NullCap \<longrightarrow> True) and ?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ((\<lambda>a. True) and ?Q366 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap)\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P376 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) src_slota c) and ?Q'362 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> cdl_cnode_invocation.InsertCall rv (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota) = translate_cnode_invocation (cnode_invocation.InsertCall rv' src_slota dest_slota)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace> whenE (rv = cdl_cap.NullCap) throw \<lbrace>\<lambda>rva _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace> whenE (rv' = cap.NullCap) (throwError IllegalOperation) \<lbrace>\<lambda>rv'a _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa)) \<lbrace>\<lambda>rv. (\<lambda>s. rv = cdl_cap.NullCap \<longrightarrow> True) and ?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'362 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa\<rbrace> CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa) \<lbrace>\<lambda>rv'. (\<lambda>s. rv' = cap.NullCap \<longrightarrow> True) and ?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ((\<lambda>a. True) and ?Q366 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap)\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P376 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) src_slota c) and ?Q'362 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace> whenE (rv = cdl_cap.NullCap) throw \<lbrace>\<lambda>rva _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace> whenE (rv' = cap.NullCap) (throwError IllegalOperation) \<lbrace>\<lambda>rv'a _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr src_slota) (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa)) \<lbrace>\<lambda>rv. (\<lambda>s. rv = cdl_cap.NullCap \<longrightarrow> True) and ?Q381 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'362 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa\<rbrace> CSpace_A.derive_cap src_slota (mask_cap (data_to_rights x21) src_capa) \<lbrace>\<lambda>rv'. (\<lambda>s. rv' = cap.NullCap \<longrightarrow> True) and ?Q'383 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q343 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ((\<lambda>a. True) and ?Q366 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_cap)\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'339 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P376 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) src_slota c) and ?Q'362 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota src_slot src_slota src_capa)\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q343 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'339 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q309 index bits src_index src_depth x21 x22 a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q319 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'311 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'321 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 23 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> mdb_cte_at (\<lambda>c. cte_wp_at (?P673 index bits src_index src_depth x21 x22 a aa b zs) c s) (cdt s)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 3. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (11 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s; valid_mdb s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> mdb_cte_at (\<lambda>c. cte_wp_at (?P673 index bits src_index src_depth x21 x22 a aa b zs) c s) (cdt s)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_mdb s
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 4. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_mdb s
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s; valid_mdb s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> mdb_cte_at (\<lambda>c. cte_wp_at (?P673 index bits src_index src_depth x21 x22 a aa b zs) c s) (cdt s)
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 4. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeCopy \<in> set [CNodeCopy .e. CNodeMutate]; CNodeCopy \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeCopy; ui = CNodeCopyIntent index bits src_index src_depth (data_to_rights x21); excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s; valid_mdb s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> mdb_cte_at (\<lambda>c. cte_wp_at (?P673 index bits src_index src_depth x21 x22 a aa b zs) c s) (cdt s)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 3. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 2. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (11 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q727 index bits src_index src_depth x21 x21a x22a a aa b zs) (?Q'727 index bits src_index src_depth x21 x21a x22a a aa b zs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slot)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ?Q727 index bits src_index src_depth x21 x21a x22a a aa b zs s
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'727 index bits src_index src_depth x21 x21a x22a a aa b zs s
 4. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'731 index bits src_index src_depth x21 x21a x22a a aa b zs) (?P731 index bits src_index src_depth x21 x21a x22a a aa b zs) (?P'731 index bits src_index src_depth x21 x21a x22a a aa b zs) (CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits)) (CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits))
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; ?r'731 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R731 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot) (?R'731 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> (?P731 index bits src_index src_depth x21 x21a x22a a aa b zs and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (?P'731 index bits src_index src_depth x21 x21a x22a a aa b zs and ?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 7. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R731 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot) (?R'731 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 6. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R731 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)) (?R'731 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty (transform_cslot_ptr dest_slota);
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot (transform_cslot_ptr dest_slota))
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 6. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R751 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y) (?R'751 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya) (doE src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap src_slot new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap src_slot (transform_cslot_ptr dest_slota))
odE) (doE src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap src_slot (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap src_slot dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>?R751 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>?R'751 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 8. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya) (?P763 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y) (?P'765 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya) (CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth)) (CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth))
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya; ?r'762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya rv) (?R'762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya rv') (doE src_cap <- liftE (KHeap_D.get_cap rv);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap rv new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap rv (transform_cslot_ptr dest_slota))
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap rv');
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap rv' (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. ?P763 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. ?P'765 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya rv) (?R'762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya rv') (doE src_cap <- liftE (KHeap_D.get_cap rv);
new_cap' <- liftE (CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap));
cap <- CSpace_D.derive_cap rv new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap rv (transform_cslot_ptr dest_slota))
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap rv');
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap rv' (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 10. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R762 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')) (?R'762 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv') (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr rv');
new_cap' <- CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
doE cap <- CSpace_D.derive_cap (transform_cslot_ptr rv') new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (do src_cap <- CSpaceAcc_A.get_cap rv';
doE y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap rv' (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_cap));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE
od)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'762 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 10. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
A total of 17 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> dcorres (?r'787 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv') (?P798 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')) (?P'794 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv') (KHeap_D.get_cap (transform_cslot_ptr rv')) (CSpaceAcc_A.get_cap rv')
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; ?r'787 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R787 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap) (?R'787 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa) (do new_cap' <- CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
doE cap <- CSpace_D.derive_cap (transform_cslot_ptr rv') new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap rv' (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_capa));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>?R787 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>?R'787 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. ?P798 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. ?P'794 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R787 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap) (?R'787 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa) (do new_cap' <- CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
doE cap <- CSpace_D.derive_cap (transform_cslot_ptr rv') new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap rv' (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_capa));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>?R787 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>?R'787 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (\<lambda>_. True) (\<lambda>_. True) (do new_cap' <- CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
doE cap <- CSpace_D.derive_cap (transform_cslot_ptr rv') new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap rv' (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_capa));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q811 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap) (?Q'812 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa) (do new_cap' <- CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
doE cap <- CSpace_D.derive_cap (transform_cslot_ptr rv') new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap rv' (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_capa));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q811 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'812 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q811 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap) (?Q'812 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa) (do new_cap' <- CSpace_D.update_cap_data False x21a (update_cap_rights (Types_D.cap_rights src_cap \<inter> data_to_rights x21) src_cap);
doE cap <- CSpace_D.derive_cap (transform_cslot_ptr rv') new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
new_cap <- CSpace_A.derive_cap rv' (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_capa));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q811 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'812 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q811 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' (transform_cap src_capa)) (?Q'812 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (do new_cap' <- CSpace_D.update_cap_data False x21a (update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa));
doE cap <- CSpace_D.derive_cap (transform_cslot_ptr rv') new_cap';
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE new_cap <- CSpace_A.derive_cap rv' (CSpace_A.update_cap_data False x21a (mask_cap (data_to_rights x21) src_capa));
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q811 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'812 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> update_cap_rights (Structures_A.cap_rights src_capa \<inter> data_to_rights x21) (transform_cap src_capa) = transform_cap (mask_cap (data_to_rights x21) src_capa)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (\<lambda>_. True) (?P'815 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (doE cap <- CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c');
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE) (doE new_cap <- CSpace_A.derive_cap rv' c';
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ?P'815 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (\<lambda>_. True) (?P'815 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (doE cap <- CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c');
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE) (doE new_cap <- CSpace_A.derive_cap rv' c';
y <- whenE (new_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall new_cap rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ?P'815 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
A total of 19 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'819 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c') (\<lambda>_. True) (?P'824 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c')) (CSpace_A.derive_cap rv' c')
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; ?r'819 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (\<lambda>_. True) (?R'819 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a) (doE y <- whenE (rva = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall rva (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (rv'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall rv'a rv' dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c') \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>?R'819 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and (?P'824 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa and ?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa))\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (\<lambda>_. True) (?R'819 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a) (doE y <- whenE (rva = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.InsertCall rva (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (rv'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.InsertCall rv'a rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c') \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>?R'819 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and ?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa))\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 21 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (?P'840 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a) (whenE (rva = cdl_cap.NullCap) throw) (whenE (rv'a = cap.NullCap) (throwError IllegalOperation))
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb rv'b. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb) (?R'839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rv'b) (returnOk (cdl_cnode_invocation.InsertCall rva (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.InsertCall rv'a rv' dest_slota))
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError IllegalOperation) \<lbrace>?R'839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c') \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>\<lambda>rv'a. ?P'840 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a and ?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and ?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa))\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 24 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> (rva = cdl_cap.NullCap) = (rv'a = cap.NullCap)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (?P'848 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a) throw (throwError IllegalOperation)
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dc () ()
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb rv'b. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb) (?R'839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rv'b) (returnOk (cdl_cnode_invocation.InsertCall rva (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.InsertCall rv'a rv' dest_slota))
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError IllegalOperation) \<lbrace>?R'839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c') \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> ?P'848 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a s) and ?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and ?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa))\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (?P'848 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a) throw (throwError IllegalOperation)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb rv'b. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb) (?R'839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rv'b) (returnOk (cdl_cnode_invocation.InsertCall rva (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.InsertCall rv'a rv' dest_slota))
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError IllegalOperation) \<lbrace>?R'839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c') \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> ?P'848 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a s) and ?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and ?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa))\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb rv'b. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb) (?R'839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rv'b) (returnOk (cdl_cnode_invocation.InsertCall rva (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.InsertCall rv'a rv' dest_slota))
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError IllegalOperation) \<lbrace>?R'839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c') \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and ?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa))\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb rv'b. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb) (?R'839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rv'b) (returnOk (cdl_cnode_invocation.InsertCall rva (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.InsertCall rv'a rv' dest_slota))
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError IllegalOperation) \<lbrace>?R'839 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c') \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and ?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa))\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a rvb rv'b. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> cdl_cnode_invocation.InsertCall rva (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota) = translate_cnode_invocation (cnode_invocation.InsertCall rv'a rv' dest_slota)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>\<lambda>rvb _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError IllegalOperation) \<lbrace>\<lambda>rv'b _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c') \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and ?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa))\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>\<lambda>rvb _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva rv'a. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError IllegalOperation) \<lbrace>\<lambda>rv'b _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr rv') (transform_cap c') \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'841 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and ?Q'822 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa))\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 22 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P'881 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>\<lambda>rv'a s. (rv'a = cap.NullCap \<longrightarrow> True) \<and> True \<and> True\<rbrace>, -
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and (\<lambda>c. True \<and> ?P'881 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa c)))\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P'881 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa\<rbrace> CSpace_A.derive_cap rv' c' \<lbrace>?Q'889 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; ?Q'889 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva s\<rbrakk> \<Longrightarrow> (rva = cap.NullCap \<longrightarrow> True) \<and> True \<and> True
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and (\<lambda>c. True \<and> ?P'881 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa c)))\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c' rva s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; True\<rbrakk> \<Longrightarrow> (rva = cap.NullCap \<longrightarrow> True) \<and> True \<and> True
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> mask_cap (data_to_rights x21) src_capa) and ((\<lambda>c. mdb_cte_at (swp (cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv' src_capa)) c) (cdt c) \<and> cte_wp_at (\<lambda>_. True) rv' c) and (\<lambda>a. True \<and> True)))\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q796 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'792 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
A total of 19 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'916 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>rv s. s \<turnstile> mask_cap (data_to_rights x21) rv \<and> mdb_cte_at (\<lambda>c. cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' rv) c s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) rv' s\<rbrace>
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. opt_cap a b \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True)) b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and (\<lambda>d. True \<and> valid_idle d \<and> ?P'916 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c d)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 10. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'916 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>r s. s \<turnstile> r \<and> mdb_cte_at (\<lambda>c. cte_wp_at (?P833 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' r) c s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) rv' s\<rbrace>
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. opt_cap a b \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True)) b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and (\<lambda>d. True \<and> valid_idle d \<and> ?P'916 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y ya c d)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q764 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'766 index bits src_index src_depth x21 x21a x22a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q757 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'756 index bits src_index src_depth x21 x21a x22a a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'731 index bits src_index src_depth x21 x21a x22a a aa b zs) s
 10. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
A total of 17 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> mdb_cte_at (\<lambda>c. cte_wp_at (?P1116 index bits src_index src_depth x21 x21a x22a a aa b zs) c s) (cdt s)
 2. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (10 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s; valid_mdb s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> mdb_cte_at (\<lambda>c. cte_wp_at (?P1116 index bits src_index src_depth x21 x21a x22a a aa b zs) c s) (cdt s)
 2. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_mdb s
 3. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits src_index src_depth x21 x21a x22a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x21a # x22a; CNodeMint \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMint \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMint; ui = CNodeMintIntent index bits src_index src_depth (data_to_rights x21) x21a; excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_mdb s
 2. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (10 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q1172 index bits src_index src_depth args'a a aa b zs) (?Q'1172 index bits src_index src_depth args'a a aa b zs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slot)
odE)
 2. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ?Q1172 index bits src_index src_depth args'a a aa b zs s
 3. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'1172 index bits src_index src_depth args'a a aa b zs s
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (13 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'1176 index bits src_index src_depth args'a a aa b zs) (?P1176 index bits src_index src_depth args'a a aa b zs) (?P'1176 index bits src_index src_depth args'a a aa b zs) (CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits)) (CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits))
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; ?r'1176 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1176 index bits src_index src_depth args'a a aa b zs dest_slot) (?R'1176 index bits src_index src_depth args'a a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slota)
odE)
 3. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> (?P1176 index bits src_index src_depth args'a a aa b zs and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 6. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (?P'1176 index bits src_index src_depth args'a a aa b zs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> index = of_bl (to_bl index)
 2. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> length (to_bl index) = 32
 3. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> cdl_cap.CNodeCap word (of_bl x) (length x) n = transform_cap (cap.CNodeCap word n x)
 4. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> unat bits = unat bits
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1176 index bits src_index src_depth args'a a aa b zs dest_slot) (?R'1176 index bits src_index src_depth args'a a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slota)
odE)
 6. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 9. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> length (to_bl index) = 32
 2. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> cdl_cap.CNodeCap word (of_bl x) (length x) n = transform_cap (cap.CNodeCap word n x)
 3. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> unat bits = unat bits
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1176 index bits src_index src_depth args'a a aa b zs dest_slot) (?R'1176 index bits src_index src_depth args'a a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slota)
odE)
 5. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 8. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> cdl_cap.CNodeCap word (of_bl x) (length x) n = transform_cap (cap.CNodeCap word n x)
 2. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> unat bits = unat bits
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1176 index bits src_index src_depth args'a a aa b zs dest_slot) (?R'1176 index bits src_index src_depth args'a a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slota)
odE)
 4. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 7. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> unat bits = unat bits
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1176 index bits src_index src_depth args'a a aa b zs dest_slot) (?R'1176 index bits src_index src_depth args'a a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slota)
odE)
 3. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 6. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1176 index bits src_index src_depth args'a a aa b zs dest_slot) (?R'1176 index bits src_index src_depth args'a a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slota)
odE)
 2. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1176 index bits src_index src_depth args'a a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 5. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota) (?P1188 index bits src_index src_depth args'a a aa b zs dest_slot) (?P'1190 index bits src_index src_depth args'a a aa b zs dest_slota) (CSpace_D.ensure_empty dest_slot) (CSpaceAcc_A.ensure_empty dest_slota)
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; ?r'1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y) (?R'1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya) (doE src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slota)
odE)
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>?R1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>?R'1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. ?P1188 index bits src_index src_depth args'a a aa b zs dest_slot and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. ?P'1190 index bits src_index src_depth args'a a aa b zs dest_slota and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 8. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'1187 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota) (?P1188 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota)) (?P'1190 index bits src_index src_depth args'a a aa b zs dest_slota) (CSpace_D.ensure_empty (transform_cslot_ptr dest_slota)) (CSpaceAcc_A.ensure_empty dest_slota)
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; ?r'1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y) (?R'1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya) (doE src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slota)
odE)
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>?R1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>?R'1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. ?P1188 index bits src_index src_depth args'a a aa b zs dest_slot and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. ?P'1190 index bits src_index src_depth args'a a aa b zs dest_slota and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 8. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y) (?R'1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya) (doE src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slot dest_slota)
odE)
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>?R1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>?R'1187 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 7. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya) (?P1198 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y) (?P'1200 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya) (CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth)) (CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth))
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya; ?r'1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya src_slot src_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya src_slot) (?R'1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya src_slota) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slota dest_slota)
odE)
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. ?P1198 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y and ?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. ?P'1200 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya and ?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 10. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya src_slot) (?R'1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya src_slota) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap src_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slota dest_slota)
odE)
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 9. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1197 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)) (?R'1197 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr src_slota);
doE y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE
od) (do src_cap <- CSpaceAcc_A.get_cap src_slota;
doE y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_cap) src_slota dest_slota)
odE
od)
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'1197 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 9. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
A total of 16 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> dcorres (?r'1214 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota) (?P1225 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)) (?P'1221 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota) (KHeap_D.get_cap (transform_cslot_ptr src_slota)) (CSpaceAcc_A.get_cap src_slota)
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; ?r'1214 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1214 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap) (?R'1214 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_capa) (doE y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_capa) src_slota dest_slota)
odE)
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1223 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>?R1214 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1219 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>?R'1214 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. ?P1225 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c and ?Q1223 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. ?P'1221 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c and ?Q'1219 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1214 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap) (?R'1214 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_capa) (doE y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_capa) src_slota dest_slota)
odE)
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1223 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>?R1214 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota\<rbrace>
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1219 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>?R'1214 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1223 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1219 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_capa) src_slota dest_slota)
odE)
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q1235 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap) (?Q'1236 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_capa) (doE y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_capa) src_slota dest_slota)
odE)
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1223 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1235 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1219 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'1236 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_capa\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1223 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1219 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q1235 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap) (?Q'1236 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_capa) (doE y <- whenE (src_cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall src_cap (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_capa) src_slota dest_slota)
odE)
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1223 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1235 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap\<rbrace>
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1219 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'1236 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_capa\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1223 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1219 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q1235 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cap src_capa)) (?Q'1236 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota src_capa) (returnOk (cdl_cnode_invocation.MoveCall (transform_cap src_capa) (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.MoveCall (mask_cap all_rights src_capa) src_slota dest_slota))
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1223 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1235 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap\<rbrace>
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1219 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'1236 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_capa\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1223 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1219 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota src_cap src_capa s s'. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True; K (wellformed_cap src_capa) s'\<rbrakk> \<Longrightarrow> cdl_cnode_invocation.MoveCall (transform_cap src_capa) (transform_cslot_ptr src_slota) (transform_cslot_ptr dest_slota) = translate_cnode_invocation (cnode_invocation.MoveCall (mask_cap all_rights src_capa) src_slota dest_slota)
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1223 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1219 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and K (wellformed_cap src_capa)\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1223 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1219 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1223 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr src_slota)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 2. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1219 index bits src_index src_depth args'a a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () src_slota\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and K (wellformed_cap src_capa)\<rbrace>
 3. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1223 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1219 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace> CSpace_D.ensure_empty dest_slot \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1199 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth args'a a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1201 index bits src_index src_depth args'a a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>a. True) and ?Q1189 index bits src_index src_depth args'a a aa b zs dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth args'a a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1176 index bits src_index src_depth args'a a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'1191 index bits src_index src_depth args'a a aa b zs dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1176 index bits src_index src_depth args'a a aa b zs) s
 10. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1176 index bits src_index src_depth args'a a aa b zs) s
A total of 17 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>index bits src_index src_depth args'a a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # args'a; CNodeMove \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMove \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMove; ui = CNodeMoveIntent index bits src_index src_depth; excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (7 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q1398 index bits src_index src_depth x21 x22 a aa b zs) (?Q'1398 index bits src_index src_depth x21 x22 a aa b zs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slot)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ?Q1398 index bits src_index src_depth x21 x22 a aa b zs s
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'1398 index bits src_index src_depth x21 x22 a aa b zs s
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (12 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'1402 index bits src_index src_depth x21 x22 a aa b zs) (?P1402 index bits src_index src_depth x21 x22 a aa b zs) (?P'1402 index bits src_index src_depth x21 x22 a aa b zs) (CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits)) (CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits))
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; ?r'1402 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1402 index bits src_index src_depth x21 x22 a aa b zs dest_slot) (?R'1402 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> (?P1402 index bits src_index src_depth x21 x22 a aa b zs and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (?P'1402 index bits src_index src_depth x21 x22 a aa b zs and ?Q'1402 index bits src_index src_depth x21 x22 a aa b zs) s
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1402 index bits src_index src_depth x21 x22 a aa b zs dest_slot) (?R'1402 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty dest_slot;
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot dest_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1402 index bits src_index src_depth x21 x22 a aa b zs) s
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1402 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)) (?R'1402 index bits src_index src_depth x21 x22 a aa b zs dest_slota) (doE y <- CSpace_D.ensure_empty (transform_cslot_ptr dest_slota);
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot (transform_cslot_ptr dest_slota))
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slota;
src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1402 index bits src_index src_depth x21 x22 a aa b zs) s
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R1422 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y) (?R'1422 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya) (doE src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth);
src_cap <- liftE (KHeap_D.get_cap src_slot);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap src_slot (transform_cslot_ptr dest_slota))
odE) (doE src_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) src_slot dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>?R1422 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>?R'1422 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1402 index bits src_index src_depth x21 x22 a aa b zs) s
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya) (?P1434 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y) (?P'1436 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya) (CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth)) (CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth))
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya; ?r'1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya rv) (?R'1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya rv') (doE src_cap <- liftE (KHeap_D.get_cap rv);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap rv (transform_cslot_ptr dest_slota))
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap rv');
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) rv' dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. ?P1434 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. ?P'1436 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1402 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya rv) (?R'1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya rv') (doE src_cap <- liftE (KHeap_D.get_cap rv);
cap <- liftE (CSpace_D.update_cap_data True x21 src_cap);
y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap rv (transform_cslot_ptr dest_slota))
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap rv');
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1402 index bits src_index src_depth x21 x22 a aa b zs) s
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R1433 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')) (?R'1433 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv') (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr rv');
cap <- CSpace_D.update_cap_data True x21 src_cap;
doE y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (do src_cap <- CSpaceAcc_A.get_cap rv';
doE y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_cap)) rv' dest_slota)
odE
od)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>?R1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>?R'1433 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1402 index bits src_index src_depth x21 x22 a aa b zs) s
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> dcorres (?r'1458 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv') (?P1469 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')) (?P'1465 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv') (KHeap_D.get_cap (transform_cslot_ptr rv')) (CSpaceAcc_A.get_cap rv')
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; ?r'1458 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R1458 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap) (?R'1458 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa) (do cap <- CSpace_D.update_cap_data True x21 src_cap;
doE y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_capa)) rv' dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>?R1458 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>?R'1458 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. ?P1469 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. ?P'1465 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?R1458 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap) (?R'1458 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa) (do cap <- CSpace_D.update_cap_data True x21 src_cap;
doE y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_capa)) rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>?R1458 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>?R'1458 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (\<lambda>_. True) (\<lambda>_. True) (do cap <- CSpace_D.update_cap_data True x21 src_cap;
doE y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_capa)) rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap) (?Q'1483 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa) (do cap <- CSpace_D.update_cap_data True x21 src_cap;
doE y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_capa)) rv' dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'1483 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap) (?Q'1483 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa) (do cap <- CSpace_D.update_cap_data True x21 src_cap;
doE y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
y <- whenE (CSpace_A.update_cap_data True x21 src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_capa)) rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'1483 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q1482 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' (transform_cap src_capa)) (?Q'1483 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (do cap <- CSpace_D.update_cap_data True x21 (transform_cap src_capa);
doE y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (CSpace_A.update_cap_data True x21 src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_capa)) rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and ?Q'1483 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q1482 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' (transform_cap src_capa)) (?P'1487 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (do cap <- CSpace_D.update_cap_data True x21 (transform_cap src_capa);
doE y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (CSpace_A.update_cap_data True x21 src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 (mask_cap all_rights src_capa)) rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (?P'1487 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa and (\<lambda>s. wellformed_cap src_capa))\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q1482 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' (transform_cap src_capa)) (?P'1487 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (do cap <- CSpace_D.update_cap_data True x21 (transform_cap src_capa);
doE y <- whenE (cap = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall cap (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (CSpace_A.update_cap_data True x21 src_capa = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall (CSpace_A.update_cap_data True x21 src_capa) rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (?P'1487 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa and (\<lambda>s. wellformed_cap src_capa))\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa\<rbrakk> \<Longrightarrow> transform_cap src_capa = transform_cap src_capa
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q1482 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' (transform_cap src_capa)) (?P'1492 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (doE y <- whenE (transform_cap c' = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall (transform_cap c') (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (c' = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall c' rv' dest_slota)
odE)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> src_capa) and ?P'1492 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa and (\<lambda>s. wellformed_cap src_capa))\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q1482 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' (transform_cap src_capa)) (?P'1492 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (doE y <- whenE (transform_cap c' = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.MoveCall (transform_cap c') (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (c' = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.MoveCall c' rv' dest_slota)
odE)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> src_capa) and ?P'1492 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa and (\<lambda>s. wellformed_cap src_capa))\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa\<rbrakk> \<Longrightarrow> dc undefined IllegalOperation
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa\<rbrakk> \<Longrightarrow> (transform_cap c' = cdl_cap.NullCap) = (c' = cap.NullCap)
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa; transform_cap c' \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q1482 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' (transform_cap src_capa)) (?P'1492 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (returnOk (cdl_cnode_invocation.MoveCall (transform_cap c') (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.MoveCall c' rv' dest_slota))
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> src_capa) and ?P'1492 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa and (\<lambda>s. wellformed_cap src_capa))\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa\<rbrakk> \<Longrightarrow> (transform_cap c' = cdl_cap.NullCap) = (c' = cap.NullCap)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa; transform_cap c' \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q1482 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' (transform_cap src_capa)) (?P'1492 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (returnOk (cdl_cnode_invocation.MoveCall (transform_cap c') (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.MoveCall c' rv' dest_slota))
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> src_capa) and ?P'1492 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa and (\<lambda>s. wellformed_cap src_capa))\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa; transform_cap c' \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. a = translate_cnode_invocation b)) (?Q1482 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' (transform_cap src_capa)) (?P'1492 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr rv') rv' src_capa) (returnOk (cdl_cnode_invocation.MoveCall (transform_cap c') (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.MoveCall c' rv' dest_slota))
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q1482 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> src_capa) and ?P'1492 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_capa and (\<lambda>s. wellformed_cap src_capa))\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv' src_cap src_capa c'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'; src_cap = transform_cap src_capa; src_capa \<noteq> cap.NullCap; wellformed_cap src_capa; transform_cap c' \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> cdl_cnode_invocation.MoveCall (transform_cap c') (transform_cslot_ptr rv') (transform_cslot_ptr dest_slota) = translate_cnode_invocation (cnode_invocation.MoveCall c' rv' dest_slota)
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (\<lambda>a. True) and (\<lambda>s. wellformed_cap src_capa))\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1467 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () (transform_cslot_ptr rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr rv') \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (\<lambda>a. True) and (\<lambda>s. wellformed_cap src_capa))\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
 10. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1402 index bits src_index src_depth x21 x22 a aa b zs) s
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota rv rv'. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; rv = transform_cslot_ptr rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1463 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota) dest_slota () () rv'\<rbrace> CSpaceAcc_A.get_cap rv' \<lbrace>\<lambda>src_capa. (\<lambda>_. True) and (valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (\<lambda>a. True) and (\<lambda>s. wellformed_cap src_capa))\<rbrace>
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) src_index (unat src_depth) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q1467 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1463 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y ya c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q1428 index bits src_index src_depth x21 x22 a aa b zs (transform_cslot_ptr dest_slota)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr dest_slota) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1435 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1427 index bits src_index src_depth x21 x22 a aa b zs dest_slota\<rbrace> CSpaceAcc_A.ensure_empty dest_slota \<lbrace>\<lambda>ya. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'1437 index bits src_index src_depth x21 x22 a aa b zs dest_slot dest_slota ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q1428 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits src_index src_depth x21 x22 a aa b zs. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1402 index bits src_index src_depth x21 x22 a aa b zs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst c) and valid_etcbs and ?Q'1427 index bits src_index src_depth x21 x22 a aa b zs c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1402 index bits src_index src_depth x21 x22 a aa b zs) s
 9. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1402 index bits src_index src_depth x21 x22 a aa b zs) s
 10. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 15 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s; valid_mdb s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s \<and> valid_objs s
 2. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_mdb s
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (7 subgoals):
 1. \<And>index bits src_index src_depth x21 x22 a aa b zs s. \<lbrakk>args' = index # bits # src_index # src_depth # x21 # x22; CNodeMutate \<in> set [CNodeCopy .e. CNodeMutate]; CNodeMutate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; gen_invocation_type label' = CNodeMutate; ui = CNodeMutateIntent index bits src_index src_depth x21; excaps' = (a, aa, b) # zs; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> s \<turnstile> a \<and> (\<forall>e\<in>set zs. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_mdb s
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (6 subgoals):
 1. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (6 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
returnOk (cdl_cnode_invocation.RevokeCall target_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
returnOk (cnode_invocation.RevokeCall dest_slot)
odE)
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q1864 index bits args'a) (?Q'1864 index bits args'a) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
returnOk (cdl_cnode_invocation.RevokeCall target_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
returnOk (cnode_invocation.RevokeCall dest_slot)
odE)
 2. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; True\<rbrakk> \<Longrightarrow> ?Q1864 index bits args'a s
 3. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'1864 index bits args'a s
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (11 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'1868 index bits args'a) (?P1868 index bits args'a) (?P'1868 index bits args'a) (CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits)) (CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits))
 2. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; ?r'1868 index bits args'a target_slot dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1868 index bits args'a target_slot) (?R'1868 index bits args'a dest_slot) (returnOk (cdl_cnode_invocation.RevokeCall target_slot)) (returnOk (cnode_invocation.RevokeCall dest_slot))
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q1868 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1868 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1868 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1868 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; True\<rbrakk> \<Longrightarrow> (?P1868 index bits args'a and ?Q1868 index bits args'a) s
 6. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (?P'1868 index bits args'a and ?Q'1868 index bits args'a) s
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R1868 index bits args'a target_slot) (?R'1868 index bits args'a dest_slot) (returnOk (cdl_cnode_invocation.RevokeCall target_slot)) (returnOk (cnode_invocation.RevokeCall dest_slot))
 2. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q1868 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R1868 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1868 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'1868 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1868 index bits args'a) s
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1868 index bits args'a) s
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (10 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> cdl_cnode_invocation.RevokeCall target_slot = translate_cnode_invocation (cnode_invocation.RevokeCall dest_slot)
 2. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q1868 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>target_slot _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1868 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slot _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1868 index bits args'a) s
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1868 index bits args'a) s
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q1868 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>target_slot _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1868 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slot _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1868 index bits args'a) s
 4. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1868 index bits args'a) s
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1868 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slot _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True)) s
 3. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'1868 index bits args'a) s
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (7 subgoals):
 1. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True)) s
 2. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> True)) s
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (6 subgoals):
 1. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeRevoke \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRevoke \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRevoke; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeRevokeIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> True)) s
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (5 subgoals):
 1. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (5 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
returnOk (cdl_cnode_invocation.DeleteCall target_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
returnOk (cnode_invocation.DeleteCall dest_slot)
odE)
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (7 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q2075 index bits args'a) (?Q'2075 index bits args'a) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
returnOk (cdl_cnode_invocation.DeleteCall target_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
returnOk (cnode_invocation.DeleteCall dest_slot)
odE)
 2. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; True\<rbrakk> \<Longrightarrow> ?Q2075 index bits args'a s
 3. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'2075 index bits args'a s
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (10 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2079 index bits args'a) (?P2079 index bits args'a) (?P'2079 index bits args'a) (CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits)) (CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits))
 2. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; ?r'2079 index bits args'a target_slot dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2079 index bits args'a target_slot) (?R'2079 index bits args'a dest_slot) (returnOk (cdl_cnode_invocation.DeleteCall target_slot)) (returnOk (cnode_invocation.DeleteCall dest_slot))
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2079 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R2079 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2079 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'2079 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; True\<rbrakk> \<Longrightarrow> (?P2079 index bits args'a and ?Q2079 index bits args'a) s
 6. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (?P'2079 index bits args'a and ?Q'2079 index bits args'a) s
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2079 index bits args'a target_slot) (?R'2079 index bits args'a dest_slot) (returnOk (cdl_cnode_invocation.DeleteCall target_slot)) (returnOk (cnode_invocation.DeleteCall dest_slot))
 2. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2079 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R2079 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2079 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'2079 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2079 index bits args'a) s
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2079 index bits args'a) s
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> cdl_cnode_invocation.DeleteCall target_slot = translate_cnode_invocation (cnode_invocation.DeleteCall dest_slot)
 2. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2079 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>target_slot _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2079 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slot _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2079 index bits args'a) s
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2079 index bits args'a) s
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2079 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>target_slot _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2079 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slot _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2079 index bits args'a) s
 4. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2079 index bits args'a) s
 5. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (6 subgoals):
 1. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True)) s
 2. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> True)) s
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (5 subgoals):
 1. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeDelete \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeDelete \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeDelete; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeDeleteIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> True)) s
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (4 subgoals):
 1. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (4 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_cnode_invocation.SaveCall target_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (cnode_invocation.SaveCall dest_slot)
odE)
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (6 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q2286 index bits args'a) (?Q'2286 index bits args'a) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_cnode_invocation.SaveCall target_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (cnode_invocation.SaveCall dest_slot)
odE)
 2. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; True\<rbrakk> \<Longrightarrow> ?Q2286 index bits args'a s
 3. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'2286 index bits args'a s
 4. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 6. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2290 index bits args'a) (?P2290 index bits args'a) (?P'2290 index bits args'a) (CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits)) (CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits))
 2. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; ?r'2290 index bits args'a target_slot dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2290 index bits args'a target_slot) (?R'2290 index bits args'a dest_slot) (doE y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_cnode_invocation.SaveCall target_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (cnode_invocation.SaveCall dest_slot)
odE)
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2290 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R2290 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2290 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'2290 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; True\<rbrakk> \<Longrightarrow> (?P2290 index bits args'a and ?Q2290 index bits args'a) s
 6. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (?P'2290 index bits args'a and ?Q'2290 index bits args'a) s
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2290 index bits args'a target_slot) (?R'2290 index bits args'a dest_slot) (doE y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_cnode_invocation.SaveCall target_slot)
odE) (doE y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (cnode_invocation.SaveCall dest_slot)
odE)
 2. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2290 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R2290 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2290 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'2290 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2290 index bits args'a) s
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2290 index bits args'a) s
 6. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (11 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2302 index bits args'a target_slot dest_slot) (?P2303 index bits args'a target_slot) (?P'2305 index bits args'a dest_slot) (CSpace_D.ensure_empty target_slot) (CSpaceAcc_A.ensure_empty dest_slot)
 2. \<And>index bits args'a target_slot dest_slot y ya. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot; ?r'2302 index bits args'a target_slot dest_slot y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2302 index bits args'a target_slot dest_slot y) (?R'2302 index bits args'a target_slot dest_slot ya) (returnOk (cdl_cnode_invocation.SaveCall target_slot)) (returnOk (cnode_invocation.SaveCall dest_slot))
 3. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2304 index bits args'a target_slot\<rbrace> CSpace_D.ensure_empty target_slot \<lbrace>?R2302 index bits args'a target_slot dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2306 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.ensure_empty dest_slot \<lbrace>?R'2302 index bits args'a target_slot dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2290 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>target_slot. ?P2303 index bits args'a target_slot and ?Q2304 index bits args'a target_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2290 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slot. ?P'2305 index bits args'a dest_slot and ?Q'2306 index bits args'a dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2290 index bits args'a) s
 8. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2290 index bits args'a) s
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2302 index bits args'a (transform_cslot_ptr dest_slot) dest_slot) (?P2303 index bits args'a (transform_cslot_ptr dest_slot)) (?P'2305 index bits args'a dest_slot) (CSpace_D.ensure_empty (transform_cslot_ptr dest_slot)) (CSpaceAcc_A.ensure_empty dest_slot)
 2. \<And>index bits args'a target_slot dest_slot y ya. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot; ?r'2302 index bits args'a target_slot dest_slot y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2302 index bits args'a target_slot dest_slot y) (?R'2302 index bits args'a target_slot dest_slot ya) (returnOk (cdl_cnode_invocation.SaveCall target_slot)) (returnOk (cnode_invocation.SaveCall dest_slot))
 3. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2304 index bits args'a target_slot\<rbrace> CSpace_D.ensure_empty target_slot \<lbrace>?R2302 index bits args'a target_slot dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2306 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.ensure_empty dest_slot \<lbrace>?R'2302 index bits args'a target_slot dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2290 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>target_slot. ?P2303 index bits args'a target_slot and ?Q2304 index bits args'a target_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2290 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slot. ?P'2305 index bits args'a dest_slot and ?Q'2306 index bits args'a dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2290 index bits args'a) s
 8. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2290 index bits args'a) s
 9. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>index bits args'a target_slot dest_slot y ya. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2302 index bits args'a target_slot dest_slot y) (?R'2302 index bits args'a target_slot dest_slot ya) (returnOk (cdl_cnode_invocation.SaveCall target_slot)) (returnOk (cnode_invocation.SaveCall dest_slot))
 2. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2304 index bits args'a target_slot\<rbrace> CSpace_D.ensure_empty target_slot \<lbrace>?R2302 index bits args'a target_slot dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2306 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.ensure_empty dest_slot \<lbrace>?R'2302 index bits args'a target_slot dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2290 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>target_slot. (\<lambda>a. True) and ?Q2304 index bits args'a target_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2290 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slot. valid_idle and not_idle_thread (fst dest_slot) and valid_etcbs and ?Q'2306 index bits args'a dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2290 index bits args'a) s
 7. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2290 index bits args'a) s
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (10 subgoals):
 1. \<And>index bits args'a target_slot dest_slot y ya. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot; dc y ya\<rbrakk> \<Longrightarrow> cdl_cnode_invocation.SaveCall target_slot = translate_cnode_invocation (cnode_invocation.SaveCall dest_slot)
 2. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2304 index bits args'a target_slot\<rbrace> CSpace_D.ensure_empty target_slot \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2306 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.ensure_empty dest_slot \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2290 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>target_slot. (\<lambda>a. True) and ?Q2304 index bits args'a target_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2290 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slot. valid_idle and not_idle_thread (fst dest_slot) and valid_etcbs and ?Q'2306 index bits args'a dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2290 index bits args'a) s
 7. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2290 index bits args'a) s
 8. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2304 index bits args'a target_slot\<rbrace> CSpace_D.ensure_empty target_slot \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2306 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.ensure_empty dest_slot \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2290 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>target_slot. (\<lambda>a. True) and ?Q2304 index bits args'a target_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2290 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slot. valid_idle and not_idle_thread (fst dest_slot) and valid_etcbs and ?Q'2306 index bits args'a dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2290 index bits args'a) s
 6. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2290 index bits args'a) s
 7. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (5 subgoals):
 1. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 2. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> valid_idle s \<and> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_idle) s \<and> valid_etcbs s \<and> True \<and> True)) s
 3. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (4 subgoals):
 1. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeSaveCaller \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeSaveCaller \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeSaveCaller; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeSaveCallerIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> valid_idle s \<and> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_idle) s \<and> valid_etcbs s \<and> True \<and> True)) s
 2. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 4. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (3 subgoals):
 1. \<And>index bits args'a. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (3 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
cap <- liftE (KHeap_D.get_cap target_slot);
y <- whenE (\<not> CNode_D.has_cancel_send_rights cap) throw;
returnOk (cdl_cnode_invocation.CancelBadgedSendsCall cap)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
cap <- liftE (CSpaceAcc_A.get_cap dest_slot);
y <- whenE (\<not> CSpace_A.has_cancel_send_rights cap) (throwError IllegalOperation);
returnOk (cnode_invocation.CancelBadgedSendsCall cap)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (5 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q2548 index bits args'a) (?Q'2548 index bits args'a) (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
cap <- liftE (KHeap_D.get_cap target_slot);
y <- whenE (\<not> CNode_D.has_cancel_send_rights cap) throw;
returnOk (cdl_cnode_invocation.CancelBadgedSendsCall cap)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
cap <- liftE (CSpaceAcc_A.get_cap dest_slot);
y <- whenE (\<not> CSpace_A.has_cancel_send_rights cap) (throwError IllegalOperation);
returnOk (cnode_invocation.CancelBadgedSendsCall cap)
odE)
 2. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ?Q2548 index bits args'a s
 3. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'2548 index bits args'a s
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 5. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2552 index bits args'a) (?P2552 index bits args'a) (?P'2552 index bits args'a) (CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits)) (CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits))
 2. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; ?r'2552 index bits args'a target_slot dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2552 index bits args'a target_slot) (?R'2552 index bits args'a dest_slot) (doE cap <- liftE (KHeap_D.get_cap target_slot);
y <- whenE (\<not> CNode_D.has_cancel_send_rights cap) throw;
returnOk (cdl_cnode_invocation.CancelBadgedSendsCall cap)
odE) (doE cap <- liftE (CSpaceAcc_A.get_cap dest_slot);
y <- whenE (\<not> CSpace_A.has_cancel_send_rights cap) (throwError IllegalOperation);
returnOk (cnode_invocation.CancelBadgedSendsCall cap)
odE)
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R2552 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'2552 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> (?P2552 index bits args'a and ?Q2552 index bits args'a) s
 6. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (?P'2552 index bits args'a and ?Q'2552 index bits args'a) s
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (7 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2552 index bits args'a target_slot) (?R'2552 index bits args'a dest_slot) (doE cap <- liftE (KHeap_D.get_cap target_slot);
y <- whenE (\<not> CNode_D.has_cancel_send_rights cap) throw;
returnOk (cdl_cnode_invocation.CancelBadgedSendsCall cap)
odE) (doE cap <- liftE (CSpaceAcc_A.get_cap dest_slot);
y <- whenE (\<not> CSpace_A.has_cancel_send_rights cap) (throwError IllegalOperation);
returnOk (cnode_invocation.CancelBadgedSendsCall cap)
odE)
 2. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R2552 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'2552 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2552 index bits args'a) s
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2552 index bits args'a) s
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (7 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2552 index bits args'a (transform_cslot_ptr dest_slot)) (?R'2552 index bits args'a dest_slot) (do cap <- KHeap_D.get_cap (transform_cslot_ptr dest_slot);
doE y <- whenE (\<not> CNode_D.has_cancel_send_rights cap) throw;
returnOk (cdl_cnode_invocation.CancelBadgedSendsCall cap)
odE
od) (do cap <- CSpaceAcc_A.get_cap dest_slot;
doE y <- whenE (\<not> CSpace_A.has_cancel_send_rights cap) (throwError IllegalOperation);
returnOk (cnode_invocation.CancelBadgedSendsCall cap)
odE
od)
 2. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R2552 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'2552 index bits args'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2552 index bits args'a) s
 5. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2552 index bits args'a) s
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 7. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (10 subgoals):
 1. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> dcorres (?r'2564 index bits args'a target_slot dest_slot) (?P2575 index bits args'a (transform_cslot_ptr dest_slot)) (?P'2572 index bits args'a dest_slot) (KHeap_D.get_cap (transform_cslot_ptr dest_slot)) (CSpaceAcc_A.get_cap dest_slot)
 2. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; ?r'2564 index bits args'a target_slot dest_slot capa capaa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2564 index bits args'a target_slot dest_slot capa) (?R'2564 index bits args'a target_slot dest_slot capaa) (doE y <- whenE (\<not> CNode_D.has_cancel_send_rights capa) throw;
returnOk (cdl_cnode_invocation.CancelBadgedSendsCall capa)
odE) (doE y <- whenE (\<not> CSpace_A.has_cancel_send_rights capaa) (throwError IllegalOperation);
returnOk (cnode_invocation.CancelBadgedSendsCall capaa)
odE)
 3. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2573 index bits args'a (transform_cslot_ptr dest_slot)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr dest_slot) \<lbrace>?R2564 index bits args'a target_slot dest_slot\<rbrace>
 4. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2570 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.get_cap dest_slot \<lbrace>?R'2564 index bits args'a target_slot dest_slot\<rbrace>
 5. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>a. ?P2575 index bits args'a a and ?Q2573 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>a. ?P'2572 index bits args'a a and ?Q'2570 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2552 index bits args'a) s
 8. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2552 index bits args'a) s
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2564 index bits args'a target_slot dest_slot capa) (?R'2564 index bits args'a target_slot dest_slot capaa) (doE y <- whenE (\<not> CNode_D.has_cancel_send_rights capa) throw;
returnOk (cdl_cnode_invocation.CancelBadgedSendsCall capa)
odE) (doE y <- whenE (\<not> CSpace_A.has_cancel_send_rights capaa) (throwError IllegalOperation);
returnOk (cnode_invocation.CancelBadgedSendsCall capaa)
odE)
 2. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2573 index bits args'a (transform_cslot_ptr dest_slot)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr dest_slot) \<lbrace>?R2564 index bits args'a target_slot dest_slot\<rbrace>
 3. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2570 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.get_cap dest_slot \<lbrace>?R'2564 index bits args'a target_slot dest_slot\<rbrace>
 4. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q2573 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'2570 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2552 index bits args'a) s
 7. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2552 index bits args'a) s
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (12 subgoals):
 1. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2584 index bits args'a target_slot dest_slot capa capaa) (?P2585 index bits args'a target_slot dest_slot capa) (?P'2587 index bits args'a target_slot dest_slot capaa) (whenE (\<not> CNode_D.has_cancel_send_rights capa) throw) (whenE (\<not> CSpace_A.has_cancel_send_rights capaa) (throwError IllegalOperation))
 2. \<And>index bits args'a target_slot dest_slot capa capaa rv rv'. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa; ?r'2584 index bits args'a target_slot dest_slot capa capaa rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2584 index bits args'a target_slot dest_slot capa capaa rv) (?R'2584 index bits args'a target_slot dest_slot capa capaa rv') (returnOk (cdl_cnode_invocation.CancelBadgedSendsCall capa)) (returnOk (cnode_invocation.CancelBadgedSendsCall capaa))
 3. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2586 index bits args'a target_slot dest_slot capa\<rbrace> whenE (\<not> CNode_D.has_cancel_send_rights capa) throw \<lbrace>?R2584 index bits args'a target_slot dest_slot capa capaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2588 index bits args'a target_slot dest_slot capaa\<rbrace> whenE (\<not> CSpace_A.has_cancel_send_rights capaa) (throwError IllegalOperation) \<lbrace>?R'2584 index bits args'a target_slot dest_slot capa capaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2573 index bits args'a (transform_cslot_ptr dest_slot)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr dest_slot) \<lbrace>\<lambda>cap. ?P2585 index bits args'a target_slot dest_slot cap and ?Q2586 index bits args'a target_slot dest_slot cap\<rbrace>
 6. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2570 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.get_cap dest_slot \<lbrace>\<lambda>capa. ?P'2587 index bits args'a target_slot dest_slot capa and ?Q'2588 index bits args'a target_slot dest_slot capa\<rbrace>
 7. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q2573 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'2570 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2552 index bits args'a) s
 10. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2552 index bits args'a) s
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> (\<not> CNode_D.has_cancel_send_rights capa) = (\<not> CSpace_A.has_cancel_send_rights capaa)
 2. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P2595 index bits args'a target_slot dest_slot capa) (?P'2597 index bits args'a target_slot dest_slot capaa) throw (throwError IllegalOperation)
 3. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> dc () ()
 4. \<And>index bits args'a target_slot dest_slot capa capaa rv rv'. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2584 index bits args'a target_slot dest_slot capa capaa rv) (?R'2584 index bits args'a target_slot dest_slot capa capaa rv') (returnOk (cdl_cnode_invocation.CancelBadgedSendsCall capa)) (returnOk (cnode_invocation.CancelBadgedSendsCall capaa))
 5. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2586 index bits args'a target_slot dest_slot capa\<rbrace> whenE (\<not> CNode_D.has_cancel_send_rights capa) throw \<lbrace>?R2584 index bits args'a target_slot dest_slot capa capaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2588 index bits args'a target_slot dest_slot capaa\<rbrace> whenE (\<not> CSpace_A.has_cancel_send_rights capaa) (throwError IllegalOperation) \<lbrace>?R'2584 index bits args'a target_slot dest_slot capa capaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2573 index bits args'a (transform_cslot_ptr dest_slot)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr dest_slot) \<lbrace>\<lambda>cap. (\<lambda>s. \<not> CNode_D.has_cancel_send_rights cap \<longrightarrow> ?P2595 index bits args'a target_slot dest_slot cap s) and ?Q2586 index bits args'a target_slot dest_slot cap\<rbrace>
 8. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2570 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.get_cap dest_slot \<lbrace>\<lambda>capa. (\<lambda>s. \<not> CSpace_A.has_cancel_send_rights capa \<longrightarrow> ?P'2597 index bits args'a target_slot dest_slot capa s) and ?Q'2588 index bits args'a target_slot dest_slot capa\<rbrace>
 9. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q2573 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'2570 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P2595 index bits args'a target_slot dest_slot capa) (?P'2597 index bits args'a target_slot dest_slot capaa) throw (throwError IllegalOperation)
 2. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>index bits args'a target_slot dest_slot capa capaa rv rv'. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2584 index bits args'a target_slot dest_slot capa capaa rv) (?R'2584 index bits args'a target_slot dest_slot capa capaa rv') (returnOk (cdl_cnode_invocation.CancelBadgedSendsCall capa)) (returnOk (cnode_invocation.CancelBadgedSendsCall capaa))
 4. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2586 index bits args'a target_slot dest_slot capa\<rbrace> whenE (\<not> CNode_D.has_cancel_send_rights capa) throw \<lbrace>?R2584 index bits args'a target_slot dest_slot capa capaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2588 index bits args'a target_slot dest_slot capaa\<rbrace> whenE (\<not> CSpace_A.has_cancel_send_rights capaa) (throwError IllegalOperation) \<lbrace>?R'2584 index bits args'a target_slot dest_slot capa capaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2573 index bits args'a (transform_cslot_ptr dest_slot)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr dest_slot) \<lbrace>\<lambda>cap. (\<lambda>s. \<not> CNode_D.has_cancel_send_rights cap \<longrightarrow> ?P2595 index bits args'a target_slot dest_slot cap s) and ?Q2586 index bits args'a target_slot dest_slot cap\<rbrace>
 7. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2570 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.get_cap dest_slot \<lbrace>\<lambda>capa. (\<lambda>s. \<not> CSpace_A.has_cancel_send_rights capa \<longrightarrow> ?P'2597 index bits args'a target_slot dest_slot capa s) and ?Q'2588 index bits args'a target_slot dest_slot capa\<rbrace>
 8. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q2573 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'2570 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2552 index bits args'a) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>index bits args'a target_slot dest_slot capa capaa rv rv'. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2584 index bits args'a target_slot dest_slot capa capaa rv) (?R'2584 index bits args'a target_slot dest_slot capa capaa rv') (returnOk (cdl_cnode_invocation.CancelBadgedSendsCall capa)) (returnOk (cnode_invocation.CancelBadgedSendsCall capaa))
 3. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2586 index bits args'a target_slot dest_slot capa\<rbrace> whenE (\<not> CNode_D.has_cancel_send_rights capa) throw \<lbrace>?R2584 index bits args'a target_slot dest_slot capa capaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2588 index bits args'a target_slot dest_slot capaa\<rbrace> whenE (\<not> CSpace_A.has_cancel_send_rights capaa) (throwError IllegalOperation) \<lbrace>?R'2584 index bits args'a target_slot dest_slot capa capaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2573 index bits args'a (transform_cslot_ptr dest_slot)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr dest_slot) \<lbrace>\<lambda>cap. (\<lambda>s. \<not> CNode_D.has_cancel_send_rights cap \<longrightarrow> True) and ?Q2586 index bits args'a target_slot dest_slot cap\<rbrace>
 6. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2570 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.get_cap dest_slot \<lbrace>\<lambda>capa. (\<lambda>s. \<not> CSpace_A.has_cancel_send_rights capa \<longrightarrow> True) and ?Q'2588 index bits args'a target_slot dest_slot capa\<rbrace>
 7. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q2573 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'2570 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2552 index bits args'a) s
 10. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2552 index bits args'a) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>index bits args'a target_slot dest_slot capa capaa rv rv'. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2584 index bits args'a target_slot dest_slot capa capaa rv) (?R'2584 index bits args'a target_slot dest_slot capa capaa rv') (returnOk (cdl_cnode_invocation.CancelBadgedSendsCall capa)) (returnOk (cnode_invocation.CancelBadgedSendsCall capaa))
 2. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2586 index bits args'a target_slot dest_slot capa\<rbrace> whenE (\<not> CNode_D.has_cancel_send_rights capa) throw \<lbrace>?R2584 index bits args'a target_slot dest_slot capa capaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2588 index bits args'a target_slot dest_slot capaa\<rbrace> whenE (\<not> CSpace_A.has_cancel_send_rights capaa) (throwError IllegalOperation) \<lbrace>?R'2584 index bits args'a target_slot dest_slot capa capaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2573 index bits args'a (transform_cslot_ptr dest_slot)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr dest_slot) \<lbrace>\<lambda>cap. (\<lambda>s. \<not> CNode_D.has_cancel_send_rights cap \<longrightarrow> True) and ?Q2586 index bits args'a target_slot dest_slot cap\<rbrace>
 5. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2570 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.get_cap dest_slot \<lbrace>\<lambda>capa. (\<lambda>s. \<not> CSpace_A.has_cancel_send_rights capa \<longrightarrow> True) and ?Q'2588 index bits args'a target_slot dest_slot capa\<rbrace>
 6. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q2573 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'2570 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2552 index bits args'a) s
 9. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2552 index bits args'a) s
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>index bits args'a target_slot dest_slot capa capaa rv rv'. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa; dc rv rv'\<rbrakk> \<Longrightarrow> cdl_cnode_invocation.CancelBadgedSendsCall capa = translate_cnode_invocation (cnode_invocation.CancelBadgedSendsCall capaa)
 2. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2586 index bits args'a target_slot dest_slot capa\<rbrace> whenE (\<not> CNode_D.has_cancel_send_rights capa) throw \<lbrace>\<lambda>rv _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2588 index bits args'a target_slot dest_slot capaa\<rbrace> whenE (\<not> CSpace_A.has_cancel_send_rights capaa) (throwError IllegalOperation) \<lbrace>\<lambda>rv' _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2573 index bits args'a (transform_cslot_ptr dest_slot)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr dest_slot) \<lbrace>\<lambda>cap. (\<lambda>s. \<not> CNode_D.has_cancel_send_rights cap \<longrightarrow> True) and ?Q2586 index bits args'a target_slot dest_slot cap\<rbrace>
 5. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2570 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.get_cap dest_slot \<lbrace>\<lambda>capa. (\<lambda>s. \<not> CSpace_A.has_cancel_send_rights capa \<longrightarrow> True) and ?Q'2588 index bits args'a target_slot dest_slot capa\<rbrace>
 6. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q2573 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'2570 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2552 index bits args'a) s
 9. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2552 index bits args'a) s
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2586 index bits args'a target_slot dest_slot capa\<rbrace> whenE (\<not> CNode_D.has_cancel_send_rights capa) throw \<lbrace>\<lambda>rv _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits args'a target_slot dest_slot capa capaa. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot; capa = transform_cap capaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2588 index bits args'a target_slot dest_slot capaa\<rbrace> whenE (\<not> CSpace_A.has_cancel_send_rights capaa) (throwError IllegalOperation) \<lbrace>\<lambda>rv' _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q2573 index bits args'a (transform_cslot_ptr dest_slot)\<rbrace> KHeap_D.get_cap (transform_cslot_ptr dest_slot) \<lbrace>\<lambda>cap. (\<lambda>s. \<not> CNode_D.has_cancel_send_rights cap \<longrightarrow> True) and ?Q2586 index bits args'a target_slot dest_slot cap\<rbrace>
 4. \<And>index bits args'a target_slot dest_slot. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; target_slot = transform_cslot_ptr dest_slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2570 index bits args'a dest_slot\<rbrace> CSpaceAcc_A.get_cap dest_slot \<lbrace>\<lambda>capa. (\<lambda>s. \<not> CSpace_A.has_cancel_send_rights capa \<longrightarrow> True) and ?Q'2588 index bits args'a target_slot dest_slot capa\<rbrace>
 5. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q2552 index bits args'a\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q2573 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits args'a. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2552 index bits args'a\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'2570 index bits args'a a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2552 index bits args'a) s
 8. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2552 index bits args'a) s
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (3 subgoals):
 1. \<And>index bits args'a s. \<lbrakk>args' = index # bits # args'a; CNodeCancelBadgedSends \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeCancelBadgedSends \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeCancelBadgedSends; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; ui = CNodeCancelBadgedSendsIntent index bits; invs s \<and> s \<turnstile> cap.CNodeCap word n x \<and> (\<forall>e\<in>set excaps'. s \<turnstile> fst e) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 3. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a pivot_root_cap src_root_cap exs'. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; map fst excaps' = pivot_root_cap # src_root_cap # exs'; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 2. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth);
pivot_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth);
y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw;
y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
src_slot <- CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth);
pivot_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth);
y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) (throwError IllegalOperation);
y <- whenE (src_slot \<noteq> dest_slot) (CSpaceAcc_A.ensure_empty dest_slot);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slot);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slot pivot_slot dest_slot)
odE)
 2. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (4 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?Q2856 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) (?Q'2856 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) (doE dest_slot <- CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits);
src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth);
pivot_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth);
y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw;
y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
src_slot <- CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth);
pivot_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth);
y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) (throwError IllegalOperation);
y <- whenE (src_slot \<noteq> dest_slot) (CSpaceAcc_A.ensure_empty dest_slot);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slot);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slot pivot_slot dest_slot)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ?Q2856 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'2856 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s
 4. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (7 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) (?P2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) (?P'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) (CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits)) (CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; ?r'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot) (?R'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota) (doE src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth);
pivot_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth);
y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw;
y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_slot <- CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth);
pivot_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth);
y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slota) (throwError IllegalOperation);
y <- whenE (src_slot \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slot);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slot pivot_slot dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> (?P2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (?P'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 7. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (6 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot) (?R'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota) (doE src_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth);
pivot_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth);
y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw;
y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_slot <- CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth);
pivot_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth);
y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slota) (throwError IllegalOperation);
y <- whenE (src_slot \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slot);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slot);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slot pivot_slot dest_slota)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>?R2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>?R'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 6. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2872 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota) (?P2873 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot) (?P'2875 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota) (CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth)) (CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; ?r'2872 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2872 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot) (?R'2872 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota) (doE pivot_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth);
y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw;
y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE pivot_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth);
y <- whenE (pivot_slot = src_slota \<or> pivot_slot = dest_slota) (throwError IllegalOperation);
y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slot);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slot dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>?R2872 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>?R'2872 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. ?P2873 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. ?P'2875 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2872 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot) (?R'2872 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota) (doE pivot_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth);
y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw;
y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE pivot_slot <- CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth);
y <- whenE (pivot_slot = src_slota \<or> pivot_slot = dest_slota) (throwError IllegalOperation);
y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slot);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slot dest_slota)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>?R2872 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>?R'2872 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (11 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2889 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota) (?P2890 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot) (?P'2892 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota) (CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth)) (CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; ?r'2889 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2889 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot) (?R'2889 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota) (doE y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw;
y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation);
y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>?R2889 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>?R'2889 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. ?P2890 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. ?P'2892 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2889 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot) (?R'2889 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota) (doE y <- whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw;
y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation);
y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>?R2889 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>?R'2889 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (13 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota) (\<lambda>_. True) (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) (whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw) (whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; ?r'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv) (?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv') (doE y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota) (\<lambda>_. True) (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) (whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw) (whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; ?r'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv) (?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv') (doE y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota) (?Q2912 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s') (?Q'2912 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s') (whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw) (whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> ?Q2912 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) sa\<rbrakk> \<Longrightarrow> ?Q'2912 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; ?r'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv) (?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv') (doE y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (pivot_slot = src_slot \<or> pivot_slot = dest_slot) = (pivot_slota = src_slota \<or> pivot_slota = dest_slota)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P2916 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s') (?P'2916 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s') throw (throwError IllegalOperation)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dc () ()
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> pivot_slot = src_slot \<or> pivot_slot = dest_slot \<longrightarrow> ?P2916 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) sa\<rbrakk> \<Longrightarrow> pivot_slota = src_slota \<or> pivot_slota = dest_slota \<longrightarrow> ?P'2916 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv) (?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv') (doE y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P2916 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s') (?P'2916 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s') throw (throwError IllegalOperation)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> pivot_slot = src_slot \<or> pivot_slot = dest_slot \<longrightarrow> ?P2916 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) sa\<rbrakk> \<Longrightarrow> pivot_slota = src_slota \<or> pivot_slota = dest_slota \<longrightarrow> ?P'2916 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv) (?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv') (doE y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> pivot_slot = src_slot \<or> pivot_slot = dest_slot \<longrightarrow> True
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) sa\<rbrakk> \<Longrightarrow> pivot_slota = src_slota \<or> pivot_slota = dest_slota \<longrightarrow> True
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv) (?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv') (doE y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> pivot_slot = src_slot \<or> pivot_slot = dest_slot \<longrightarrow> True
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) sa\<rbrakk> \<Longrightarrow> pivot_slota = src_slota \<or> pivot_slota = dest_slota \<longrightarrow> True
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv) (?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv') (doE y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; True; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota) sa\<rbrakk> \<Longrightarrow> pivot_slota = src_slota \<or> pivot_slota = dest_slota \<longrightarrow> True
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv) (?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv') (doE y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv) (?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv') (doE y <- whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot);
src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE y <- whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota);
src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>?R2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>?R'2906 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv') (\<lambda>_. True) (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) (whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot)) (whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rv'a) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv') (\<lambda>_. True) (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) (whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot)) (whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rv'a) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv') (?Q2932 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s') (?Q'2932 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s') (whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot)) (whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> ?Q2932 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) sa\<rbrakk> \<Longrightarrow> ?Q'2932 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rv'a) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (src_slot \<noteq> dest_slot) = (src_slota \<noteq> dest_slota)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv') (?P2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s') (?P'2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s') (CSpace_D.ensure_empty dest_slot) (CSpaceAcc_A.ensure_empty dest_slota)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' () ()
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> src_slot \<noteq> dest_slot \<longrightarrow> ?P2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) sa\<rbrakk> \<Longrightarrow> src_slota \<noteq> dest_slota \<longrightarrow> ?P'2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rv'a) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv') (?P2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s') (?P'2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s') (CSpace_D.ensure_empty dest_slot) (CSpaceAcc_A.ensure_empty dest_slota)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' () ()
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> src_slot \<noteq> dest_slot \<longrightarrow> ?P2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) sa\<rbrakk> \<Longrightarrow> src_slota \<noteq> dest_slota \<longrightarrow> ?P'2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rv'a) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; real_cte_at src_slota s' \<and> real_cte_at dest_slota s' \<and> valid_idle s' \<and> not_idle_thread (fst dest_slota) s' \<and> valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () ()) (?P2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () s s') (?P'2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () s s') (CSpace_D.ensure_empty (transform_cslot_ptr dest_slota)) (CSpaceAcc_A.ensure_empty dest_slota)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' () ()
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> src_slot \<noteq> dest_slot \<longrightarrow> ?P2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) sa\<rbrakk> \<Longrightarrow> src_slota \<noteq> dest_slota \<longrightarrow> ?P'2936 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; ?r'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rv'a) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> src_slot \<noteq> dest_slot \<longrightarrow> True
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) sa\<rbrakk> \<Longrightarrow> src_slota \<noteq> dest_slota \<longrightarrow> (valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) sa
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rv'a) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True\<rbrakk> \<Longrightarrow> src_slot \<noteq> dest_slot \<longrightarrow> True
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) sa\<rbrakk> \<Longrightarrow> src_slota \<noteq> dest_slota \<longrightarrow> (valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) sa
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rv'a) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' s s' sa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; True; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; (real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) sa\<rbrakk> \<Longrightarrow> src_slota \<noteq> dest_slota \<longrightarrow> (valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs) sa
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rv'a) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rva) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' rv'a) (doE src_cap <- liftE (KHeap_D.get_cap src_slot);
y <- whenE (src_cap = cdl_cap.NullCap) throw;
pivot_cap <- liftE (KHeap_D.get_cap pivot_slot);
y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
new_src <- liftE (CSpace_D.update_cap_data True src_new_data src_cap);
new_pivot <- liftE (CSpace_D.update_cap_data True pivot_new_data pivot_cap);
y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot src_slot pivot_slot dest_slot)
odE) (doE src_cap <- liftE (CSpaceAcc_A.get_cap src_slota);
y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
pivot_cap <- liftE (CSpaceAcc_A.get_cap pivot_slota);
y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()) (?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr src_slota);
doE y <- whenE (src_cap = cdl_cap.NullCap) throw;
do pivot_cap <- KHeap_D.get_cap (transform_cslot_ptr pivot_slota);
doE y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data pivot_cap;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od
odE
od
odE
od) (do src_cap <- CSpaceAcc_A.get_cap src_slota;
doE y <- whenE (src_cap = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
do pivot_cap <- CSpaceAcc_A.get_cap pivot_slota;
doE y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_cap = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_cap) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE
od
odE
od)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>?R2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>?R'2926 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> dcorres (?r'2948 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota) (?P2959 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()) (?P'2955 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()) (KHeap_D.get_cap (transform_cslot_ptr src_slota)) (CSpaceAcc_A.get_cap src_slota)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; ?r'2948 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2948 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap) (?R'2948 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa) (doE y <- whenE (src_cap = cdl_cap.NullCap) throw;
do pivot_cap <- KHeap_D.get_cap (transform_cslot_ptr pivot_slota);
doE y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data pivot_cap;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od
odE
od
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
do pivot_cap <- CSpaceAcc_A.get_cap pivot_slota;
doE y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE
od
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>?R2948 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>?R'2948 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. ?P2959 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>\<lambda>c. ?P'2955 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c and ?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2948 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap) (?R'2948 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa) (doE y <- whenE (src_cap = cdl_cap.NullCap) throw;
do pivot_cap <- KHeap_D.get_cap (transform_cslot_ptr pivot_slota);
doE y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data pivot_cap;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od
odE
od
odE) (doE y <- whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth))));
do pivot_cap <- CSpaceAcc_A.get_cap pivot_slota;
doE y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE
od
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>?R2948 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>?R'2948 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and ?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and ?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and ?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa) (?P2969 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap) (?P'2971 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa) (whenE (src_cap = cdl_cap.NullCap) throw) (whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; ?r'2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv) (?R'2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv') (do pivot_cap <- KHeap_D.get_cap (transform_cslot_ptr pivot_slota);
doE y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data pivot_cap;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od
odE
od) (do pivot_cap <- CSpaceAcc_A.get_cap pivot_slota;
doE y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE
od)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>?R2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>?R'2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. ?P2969 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. ?P'2971 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and ?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P2979 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap) (?P'2981 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa) throw (throwError (FailedLookup True (MissingCapability (unat src_depth))))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv) (?R'2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv') (do pivot_cap <- KHeap_D.get_cap (transform_cslot_ptr pivot_slota);
doE y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data pivot_cap;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od
odE
od) (do pivot_cap <- CSpaceAcc_A.get_cap pivot_slota;
doE y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE
od)
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>?R2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>?R'2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> ?P2979 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap s) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> ?P'2981 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa s) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and ?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv) (?R'2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv') (do pivot_cap <- KHeap_D.get_cap (transform_cslot_ptr pivot_slota);
doE y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data pivot_cap;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od
odE
od) (do pivot_cap <- CSpaceAcc_A.get_cap pivot_slota;
doE y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE
od)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>?R2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>?R'2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and ?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv) (?R'2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv') (do pivot_cap <- KHeap_D.get_cap (transform_cslot_ptr pivot_slota);
doE y <- whenE (pivot_cap = cdl_cap.NullCap) throw;
do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data pivot_cap;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od
odE
od) (do pivot_cap <- CSpaceAcc_A.get_cap pivot_slota;
doE y <- whenE (pivot_cap = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data pivot_cap = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data pivot_cap) src_slota pivot_slota dest_slota)
odE
od)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>?R2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>?R'2968 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and ?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2909 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slota\<rbrace> whenE (pivot_slota = src_slota \<or> pivot_slota = dest_slota) (throwError IllegalOperation) \<lbrace>\<lambda>rv'. real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and ?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2891 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>pivot_slot. (\<lambda>_. True) and ?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (?r'2986 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv') (?P2987 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv) (?P'2989 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv') (KHeap_D.get_cap (transform_cslot_ptr pivot_slota)) (CSpaceAcc_A.get_cap pivot_slota)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; ?r'2986 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2986 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva) (?R'2986 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a) (doE y <- whenE (rva = cdl_cap.NullCap) throw;
do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data rva;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od
odE) (doE y <- whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data rv'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data rv'a) src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>?R2986 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>?R'2986 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. ?P2987 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. ?P'2989 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv' and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and ?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2986 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva) (?R'2986 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a) (doE y <- whenE (rva = cdl_cap.NullCap) throw;
do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data rva;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od
odE) (doE y <- whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth))));
y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data rv'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data rv'a) src_slota pivot_slota dest_slota)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>?R2986 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>?R'2986 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and ?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2908 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot\<rbrace> whenE (pivot_slot = src_slot \<or> pivot_slot = dest_slot) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 20 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a) (?P3000 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva) (?P'3002 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a) (whenE (rva = cdl_cap.NullCap) throw) (whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; ?r'2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?R'2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data rva;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data rv'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data rv'a) src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>?R'2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. ?P3000 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. ?P'3002 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P3010 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva) (?P'3012 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a) throw (throwError (FailedLookup False (MissingCapability (unat pivot_depth))))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?R'2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data rva;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data rv'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data rv'a) src_slota pivot_slota dest_slota)
odE)
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>?R'2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> ?P3010 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva s) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> ?P'3012 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a s) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?R'2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data rva;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data rv'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data rv'a) src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>?R'2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?R'2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (do new_src <- CSpace_D.update_cap_data True src_new_data src_cap;
new_pivot <- CSpace_D.update_cap_data True pivot_new_data rva;
doE y <- whenE (new_src = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall new_src new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (CSpace_A.update_cap_data True src_new_data src_capa = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data rv'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall (CSpace_A.update_cap_data True src_new_data src_capa) (CSpace_A.update_cap_data True pivot_new_data rv'a) src_slota pivot_slota dest_slota)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>?R'2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?P'3021 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (do new_pivot <- CSpace_D.update_cap_data True pivot_new_data rva;
doE y <- whenE (transform_cap c' = cdl_cap.NullCap) throw;
y <- whenE (new_pivot = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall (transform_cap c') new_pivot (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE
od) (doE y <- whenE (c' = cap.NullCap) (throwError IllegalOperation);
y <- whenE (CSpace_A.update_cap_data True pivot_new_data rv'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall c' (CSpace_A.update_cap_data True pivot_new_data rv'a) src_slota pivot_slota dest_slota)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>\<lambda>c. valid_idle and (\<lambda>a. a \<turnstile> src_capa) and ?P'3021 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (doE y <- whenE (transform_cap c' = cdl_cap.NullCap) throw;
y <- whenE (transform_cap c'a = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall (transform_cap c') (transform_cap c'a) (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (c' = cap.NullCap) (throwError IllegalOperation);
y <- whenE (c'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall c' c'a src_slota pivot_slota dest_slota)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>\<lambda>c. valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (valid_idle and (\<lambda>a. a \<turnstile> rv'a) and ?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 22 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> dc undefined IllegalOperation
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> (transform_cap c' = cdl_cap.NullCap) = (c' = cap.NullCap)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b; transform_cap c' \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (doE y <- whenE (transform_cap c'a = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall (transform_cap c') (transform_cap c'a) (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (c'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall c' c'a src_slota pivot_slota dest_slota)
odE)
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>\<lambda>c. valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (valid_idle and (\<lambda>a. a \<turnstile> rv'a) and ?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> (transform_cap c' = cdl_cap.NullCap) = (c' = cap.NullCap)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b; transform_cap c' \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (doE y <- whenE (transform_cap c'a = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall (transform_cap c') (transform_cap c'a) (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (c'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall c' c'a src_slota pivot_slota dest_slota)
odE)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>\<lambda>c. valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (valid_idle and (\<lambda>a. a \<turnstile> rv'a) and ?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b; transform_cap c' \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (doE y <- whenE (transform_cap c'a = cdl_cap.NullCap) throw;
returnOk (cdl_cnode_invocation.RotateCall (transform_cap c') (transform_cap c'a) (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))
odE) (doE y <- whenE (c'a = cap.NullCap) (throwError IllegalOperation);
returnOk (cnode_invocation.RotateCall c' c'a src_slota pivot_slota dest_slota)
odE)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>\<lambda>c. valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (valid_idle and (\<lambda>a. a \<turnstile> rv'a) and ?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 22 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b; transform_cap c' \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dc undefined IllegalOperation
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b; transform_cap c' \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> (transform_cap c'a = cdl_cap.NullCap) = (c'a = cap.NullCap)
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b; transform_cap c' \<noteq> cdl_cap.NullCap; transform_cap c'a \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (returnOk (cdl_cnode_invocation.RotateCall (transform_cap c') (transform_cap c'a) (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.RotateCall c' c'a src_slota pivot_slota dest_slota))
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>\<lambda>c. valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (valid_idle and (\<lambda>a. a \<turnstile> rv'a) and ?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b; transform_cap c' \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> (transform_cap c'a = cdl_cap.NullCap) = (c'a = cap.NullCap)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b; transform_cap c' \<noteq> cdl_cap.NullCap; transform_cap c'a \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (returnOk (cdl_cnode_invocation.RotateCall (transform_cap c') (transform_cap c'a) (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.RotateCall c' c'a src_slota pivot_slota dest_slota))
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>\<lambda>c. valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (valid_idle and (\<lambda>a. a \<turnstile> rv'a) and ?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b; transform_cap c' \<noteq> cdl_cap.NullCap; transform_cap c'a \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb) (?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rv'b) (returnOk (cdl_cnode_invocation.RotateCall (transform_cap c') (transform_cap c'a) (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota))) (returnOk (cnode_invocation.RotateCall c' c'a src_slota pivot_slota dest_slota))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>?R2999 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>\<lambda>c. valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (valid_idle and (\<lambda>a. a \<turnstile> rv'a) and ?P'3028 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a rvb rv'b c' c'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a; dc rvb rv'b; transform_cap c' \<noteq> cdl_cap.NullCap; transform_cap c'a \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> cdl_cnode_invocation.RotateCall (transform_cap c') (transform_cap c'a) (transform_cslot_ptr src_slota) (transform_cslot_ptr pivot_slota) (transform_cslot_ptr dest_slota) = translate_cnode_invocation (cnode_invocation.RotateCall c' c'a src_slota pivot_slota dest_slota)
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>\<lambda>rvb _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>\<lambda>a. valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (valid_idle and (\<lambda>a. a \<turnstile> rv'a) and (\<lambda>a. True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace> whenE (rva = cdl_cap.NullCap) throw \<lbrace>\<lambda>rvb _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva rv'a. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'; rva = transform_cap rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace> whenE (rv'a = cap.NullCap) (throwError (FailedLookup False (MissingCapability (unat pivot_depth)))) \<lbrace>\<lambda>a. valid_idle and (\<lambda>a. a \<turnstile> src_capa) and (valid_idle and (\<lambda>a. a \<turnstile> rv'a) and (\<lambda>a. True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr pivot_slota) \<lbrace>\<lambda>rva. (\<lambda>s. rva = cdl_cap.NullCap \<longrightarrow> True) and ?Q3001 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rva\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace> CSpaceAcc_A.get_cap pivot_slota \<lbrace>\<lambda>rv'a. (\<lambda>s. rv'a = cap.NullCap \<longrightarrow> True) and ?Q'3003 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv rv' rv'a\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace> whenE (src_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q2988 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace> whenE (src_capa = cap.NullCap) (throwError (FailedLookup True (MissingCapability (unat src_depth)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and ?Q'2990 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap src_capa rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src_slota) \<lbrace>\<lambda>src_cap. (\<lambda>s. src_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q2970 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_cap\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota (transform_cslot_ptr src_slota) src_slota (transform_cslot_ptr pivot_slota) pivot_slota () () ()\<rbrace> CSpaceAcc_A.get_cap src_slota \<lbrace>\<lambda>src_capa. (\<lambda>s. src_capa = cap.NullCap \<longrightarrow> True) and ?Q'2972 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota src_capa\<rbrace>
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q2928 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv\<rbrace> whenE (src_slot \<noteq> dest_slot) (CSpace_D.ensure_empty dest_slot) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q2957 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv'. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; pivot_slot = transform_cslot_ptr pivot_slota; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2929 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv'\<rbrace> whenE (src_slota \<noteq> dest_slota) (CSpaceAcc_A.ensure_empty dest_slota) \<lbrace>\<lambda>c. valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and ?Q'2953 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota pivot_slot pivot_slota rv rv' c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 21 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa ad bb ae bc af bd ag be. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (ad, bb) = transform_cslot_ptr (ae, bc); (af, bd) = transform_cslot_ptr (ag, be)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3188 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr (ae, bc)) (ae, bc) (transform_cslot_ptr (ag, be))\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>\<lambda>rv s. transform_cslot_ptr (ag, be) \<noteq> transform_cslot_ptr (ae, bc) \<longrightarrow> rv \<noteq> transform_cslot_ptr (ag, be) \<and> rv \<noteq> transform_cslot_ptr (ae, bc) \<longrightarrow> ?P'3158 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr (ae, bc)) (ae, bc) (transform_cslot_ptr (ag, be)) (ag, be) rv () s\<rbrace>, -
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and (if pivot_slota = src_slota \<or> pivot_slota = dest_slota then \<lambda>a. True \<and> True else real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and (if src_slota \<noteq> dest_slota then \<lambda>a. True \<and> (valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and (\<lambda>a. \<forall>cap. cte_wp_at ((=) cap) src_slota a \<longrightarrow> ((\<lambda>s. cap = cap.NullCap \<longrightarrow> True) and (if cap = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) pivot_slota s \<longrightarrow> ((\<lambda>s. capa = cap.NullCap \<longrightarrow> True) and (if capa = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and (\<lambda>a. a \<turnstile> cap) and (valid_idle and (\<lambda>a. a \<turnstile> capa) and (\<lambda>a. True)))) s))) a)) a else valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and (\<lambda>a. \<forall>cap. cte_wp_at ((=) cap) src_slota a \<longrightarrow> ((\<lambda>s. cap = cap.NullCap \<longrightarrow> True) and (if cap = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) pivot_slota s \<longrightarrow> ((\<lambda>s. capa = cap.NullCap \<longrightarrow> True) and (if capa = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and (\<lambda>a. a \<turnstile> cap) and (valid_idle and (\<lambda>a. a \<turnstile> capa) and (\<lambda>a. True)))) s))) a)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> ?P'3188 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (10 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa ad bb ae bc af bd ag be. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (ad, bb) = transform_cslot_ptr (ae, bc); (af, bd) = transform_cslot_ptr (ag, be)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3188 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr (ae, bc)) (ae, bc) (transform_cslot_ptr (ag, be))\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap a) pivot_index (unat pivot_depth) \<lbrace>?Q'3233 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa ad bb ae bc af bd ag be\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa ad bb ae bc af bd ag be rv s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (ad, bb) = transform_cslot_ptr (ae, bc); (af, bd) = transform_cslot_ptr (ag, be); ?Q'3233 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa ad bb ae bc af bd ag be rv s\<rbrakk> \<Longrightarrow> transform_cslot_ptr (ag, be) \<noteq> transform_cslot_ptr (ae, bc) \<longrightarrow> rv \<noteq> transform_cslot_ptr (ag, be) \<and> rv \<noteq> transform_cslot_ptr (ae, bc) \<longrightarrow> ?P'3158 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr (ae, bc)) (ae, bc) (transform_cslot_ptr (ag, be)) (ag, be) rv () s
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and (if pivot_slota = src_slota \<or> pivot_slota = dest_slota then \<lambda>a. True \<and> True else real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and (if src_slota \<noteq> dest_slota then \<lambda>a. True \<and> (valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and (\<lambda>a. \<forall>cap. cte_wp_at ((=) cap) src_slota a \<longrightarrow> ((\<lambda>s. cap = cap.NullCap \<longrightarrow> True) and (if cap = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) pivot_slota s \<longrightarrow> ((\<lambda>s. capa = cap.NullCap \<longrightarrow> True) and (if capa = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and (\<lambda>a. a \<turnstile> cap) and (valid_idle and (\<lambda>a. a \<turnstile> capa) and (\<lambda>a. True)))) s))) a)) a else valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and (\<lambda>a. \<forall>cap. cte_wp_at ((=) cap) src_slota a \<longrightarrow> ((\<lambda>s. cap = cap.NullCap \<longrightarrow> True) and (if cap = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) pivot_slota s \<longrightarrow> ((\<lambda>s. capa = cap.NullCap \<longrightarrow> True) and (if capa = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and (\<lambda>a. a \<turnstile> cap) and (valid_idle and (\<lambda>a. a \<turnstile> capa) and (\<lambda>a. True)))) s))) a)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> ?P'3188 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 9. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 10. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa ad bb ae bc af bd ag be rv s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (ad, bb) = transform_cslot_ptr (ae, bc); (af, bd) = transform_cslot_ptr (ag, be); True\<rbrakk> \<Longrightarrow> transform_cslot_ptr (ag, be) \<noteq> transform_cslot_ptr (ae, bc) \<longrightarrow> rv \<noteq> transform_cslot_ptr (ag, be) \<and> rv \<noteq> transform_cslot_ptr (ae, bc) \<longrightarrow> ?P'3158 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr (ae, bc)) (ae, bc) (transform_cslot_ptr (ag, be)) (ag, be) rv () s
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and (if pivot_slota = src_slota \<or> pivot_slota = dest_slota then \<lambda>a. True \<and> True else real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and (if src_slota \<noteq> dest_slota then \<lambda>a. True \<and> (valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and (\<lambda>a. \<forall>cap. cte_wp_at ((=) cap) src_slota a \<longrightarrow> ((\<lambda>s. cap = cap.NullCap \<longrightarrow> True) and (if cap = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) pivot_slota s \<longrightarrow> ((\<lambda>s. capa = cap.NullCap \<longrightarrow> True) and (if capa = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and (\<lambda>a. a \<turnstile> cap) and (valid_idle and (\<lambda>a. a \<turnstile> capa) and (\<lambda>a. True)))) s))) a)) a else valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and (\<lambda>a. \<forall>cap. cte_wp_at ((=) cap) src_slota a \<longrightarrow> ((\<lambda>s. cap = cap.NullCap \<longrightarrow> True) and (if cap = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) pivot_slota s \<longrightarrow> ((\<lambda>s. capa = cap.NullCap \<longrightarrow> True) and (if capa = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and (\<lambda>a. a \<turnstile> cap) and (valid_idle and (\<lambda>a. a \<turnstile> capa) and (\<lambda>a. True)))) s))) a)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>pivot_slota. real_cte_at pivot_slota and real_cte_at src_slota and real_cte_at dest_slota and (if pivot_slota = src_slota \<or> pivot_slota = dest_slota then \<lambda>a. True \<and> True else real_cte_at src_slota and real_cte_at dest_slota and valid_idle and not_idle_thread (fst dest_slota) and valid_etcbs and (if src_slota \<noteq> dest_slota then \<lambda>a. True \<and> (valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and (\<lambda>a. \<forall>cap. cte_wp_at ((=) cap) src_slota a \<longrightarrow> ((\<lambda>s. cap = cap.NullCap \<longrightarrow> True) and (if cap = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) pivot_slota s \<longrightarrow> ((\<lambda>s. capa = cap.NullCap \<longrightarrow> True) and (if capa = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and (\<lambda>a. a \<turnstile> cap) and (valid_idle and (\<lambda>a. a \<turnstile> capa) and (\<lambda>a. True)))) s))) a)) a else valid_idle and not_idle_thread (fst src_slota) and valid_etcbs and (\<lambda>a. \<forall>cap. cte_wp_at ((=) cap) src_slota a \<longrightarrow> ((\<lambda>s. cap = cap.NullCap \<longrightarrow> True) and (if cap = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and not_idle_thread (fst pivot_slota) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) pivot_slota s \<longrightarrow> ((\<lambda>s. capa = cap.NullCap \<longrightarrow> True) and (if capa = cap.NullCap then \<lambda>a. True \<and> True else valid_idle and (\<lambda>a. a \<turnstile> cap) and (valid_idle and (\<lambda>a. a \<turnstile> capa) and (\<lambda>a. True)))) s))) a)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and ?Q'2893 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?P'3265 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>rv s. (src_slota \<noteq> dest_slota \<longrightarrow> rv \<noteq> src_slota \<and> rv \<noteq> dest_slota \<longrightarrow> real_cte_at src_slota s \<and> real_cte_at dest_slota s \<and> valid_idle s \<and> not_idle_thread (fst dest_slota) s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (fst src_slota) s \<and> valid_etcbs s \<and> (\<forall>cap. cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) cap) src_slota s \<longrightarrow> valid_idle s \<and> not_idle_thread (fst rv) s \<and> valid_etcbs s \<and> (\<forall>capa. capa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) capa) rv s \<longrightarrow> valid_idle s \<and> s \<turnstile> cap \<and> valid_idle s \<and> s \<turnstile> capa))) \<and> (src_slota = dest_slota \<longrightarrow> rv \<noteq> dest_slota \<longrightarrow> real_cte_at dest_slota s \<and> valid_idle s \<and> not_idle_thread (fst dest_slota) s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (fst dest_slota) s \<and> valid_etcbs s \<and> (\<forall>cap. cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) cap) dest_slota s \<longrightarrow> valid_idle s \<and> not_idle_thread (fst rv) s \<and> valid_etcbs s \<and> (\<forall>capa. capa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) capa) rv s \<longrightarrow> valid_idle s \<and> s \<turnstile> cap \<and> valid_idle s \<and> s \<turnstile> capa)))\<rbrace>, -
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and valid_cap a) s \<and> real_cte_at src_slota s \<and> real_cte_at dest_slota s \<and> ?P'3265 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (9 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota\<rbrakk> \<Longrightarrow> \<lbrace>?P'3265 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa (transform_cslot_ptr dest_slota) dest_slota src_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True a (to_bl pivot_index) (unat pivot_depth) \<lbrace>\<lambda>r. real_cte_at src_slota and valid_objs and real_cte_at dest_slota and valid_idle and not_idle_thread (fst src_slota) and not_idle_thread (fst dest_slota) and not_idle_thread (fst r) and valid_etcbs\<rbrace>, -
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota rv s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; (real_cte_at src_slota and valid_objs and real_cte_at dest_slota and valid_idle and not_idle_thread (fst src_slota) and not_idle_thread (fst dest_slota) and not_idle_thread (fst rv) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (src_slota \<noteq> dest_slota \<longrightarrow> rv \<noteq> src_slota \<and> rv \<noteq> dest_slota \<longrightarrow> real_cte_at src_slota s \<and> real_cte_at dest_slota s \<and> valid_idle s \<and> not_idle_thread (fst dest_slota) s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (fst src_slota) s \<and> valid_etcbs s \<and> (\<forall>cap. cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) cap) src_slota s \<longrightarrow> valid_idle s \<and> not_idle_thread (fst rv) s \<and> valid_etcbs s \<and> (\<forall>capa. capa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) capa) rv s \<longrightarrow> valid_idle s \<and> s \<turnstile> cap \<and> valid_idle s \<and> s \<turnstile> capa))) \<and> (src_slota = dest_slota \<longrightarrow> rv \<noteq> dest_slota \<longrightarrow> real_cte_at dest_slota s \<and> valid_idle s \<and> not_idle_thread (fst dest_slota) s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (fst dest_slota) s \<and> valid_etcbs s \<and> (\<forall>cap. cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) cap) dest_slota s \<longrightarrow> valid_idle s \<and> not_idle_thread (fst rv) s \<and> valid_etcbs s \<and> (\<forall>capa. capa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) capa) rv s \<longrightarrow> valid_idle s \<and> s \<turnstile> cap \<and> valid_idle s \<and> s \<turnstile> capa)))
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and valid_cap a) s \<and> real_cte_at src_slota s \<and> real_cte_at dest_slota s \<and> ?P'3265 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slota s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 8. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 9. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (8 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota src_slot src_slota rv s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota; src_slot = transform_cslot_ptr src_slota; (real_cte_at src_slota and valid_objs and real_cte_at dest_slota and valid_idle and not_idle_thread (fst src_slota) and not_idle_thread (fst dest_slota) and not_idle_thread (fst rv) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (src_slota \<noteq> dest_slota \<longrightarrow> rv \<noteq> src_slota \<and> rv \<noteq> dest_slota \<longrightarrow> real_cte_at src_slota s \<and> real_cte_at dest_slota s \<and> valid_idle s \<and> not_idle_thread (fst dest_slota) s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (fst src_slota) s \<and> valid_etcbs s \<and> (\<forall>cap. cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) cap) src_slota s \<longrightarrow> valid_idle s \<and> not_idle_thread (fst rv) s \<and> valid_etcbs s \<and> (\<forall>capa. capa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) capa) rv s \<longrightarrow> valid_idle s \<and> s \<turnstile> cap \<and> valid_idle s \<and> s \<turnstile> capa))) \<and> (src_slota = dest_slota \<longrightarrow> rv \<noteq> dest_slota \<longrightarrow> real_cte_at dest_slota s \<and> valid_idle s \<and> not_idle_thread (fst dest_slota) s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (fst dest_slota) s \<and> valid_etcbs s \<and> (\<forall>cap. cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) cap) dest_slota s \<longrightarrow> valid_idle s \<and> not_idle_thread (fst rv) s \<and> valid_etcbs s \<and> (\<forall>capa. capa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) capa) rv s \<longrightarrow> valid_idle s \<and> s \<turnstile> cap \<and> valid_idle s \<and> s \<turnstile> capa)))
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and valid_cap a) s \<and> real_cte_at src_slota s \<and> real_cte_at dest_slota s \<and> (real_cte_at src_slota and valid_objs and real_cte_at dest_slota and valid_idle and not_idle_thread (fst src_slota) and not_idle_thread (fst dest_slota)) s \<and> (valid_objs and (\<lambda>b. b \<turnstile> a) and valid_idle) s \<and> valid_etcbs s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 7. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 8. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (7 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap ab) src_index (unat src_depth) \<lbrace>\<lambda>src_slot. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot dest_slota. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; dest_slot = transform_cslot_ptr dest_slota\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace> CSpace_A.lookup_slot_for_cnode_op True ab (to_bl src_index) (unat src_depth) \<lbrace>\<lambda>src_slota. valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and valid_cap a) s \<and> real_cte_at src_slota s \<and> real_cte_at dest_slota s \<and> (real_cte_at src_slota and valid_objs and real_cte_at dest_slota and valid_idle and not_idle_thread (fst src_slota) and not_idle_thread (fst dest_slota)) s \<and> (valid_objs and (\<lambda>b. b \<turnstile> a) and valid_idle) s \<and> valid_etcbs s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_D.lookup_slot_for_cnode_op (cdl_cap.CNodeCap word (of_bl x) (length x) n) index (unat bits) \<lbrace>\<lambda>dest_slot. (\<lambda>_. True) and ?Q2874 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slot\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits) \<lbrace>\<lambda>dest_slota. valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs and ?Q'2876 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa dest_slota\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 6. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and ?Q'2860 index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa) s
 7. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (3 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 2. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs) s \<and> True \<and> (valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs) s \<and> True \<and> (valid_objs and valid_cap a) s \<and> (valid_objs and valid_cap ab) s \<and> (valid_objs and valid_cap (cap.CNodeCap word n x)) s \<and> (valid_objs and valid_cap ab) s \<and> valid_objs s \<and> (valid_objs and valid_cap (cap.CNodeCap word n x)) s \<and> valid_idle s \<and> (valid_objs and valid_cap ab and valid_idle) s \<and> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_idle) s \<and> (valid_objs and (\<lambda>b. b \<turnstile> a) and valid_idle) s \<and> valid_etcbs s)) s
 3. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits pivot_new_data pivot_index pivot_depth src_new_data src_index src_depth args'a a aa b ab ac ba zsa s. \<lbrakk>args' = index # bits # pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'a; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' = CNodeRotate; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = (transform_cap a, transform_cslot_ptr (aa, b)) # (transform_cap ab, transform_cslot_ptr (ac, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zsa; ui = CNodeRotateIntent index bits pivot_index pivot_depth pivot_new_data src_index src_depth src_new_data; excaps' = (a, aa, b) # (ab, ac, ba) # zsa; (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. s \<turnstile> a \<and> s \<turnstile> ab \<and> (\<forall>e\<in>set zsa. s \<turnstile> fst e)) and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_global_refs and valid_idle and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and valid_cap ab and valid_global_refs and valid_idle and valid_etcbs) s \<and> True \<and> (valid_objs and valid_cap a and valid_global_refs and valid_idle and valid_etcbs) s \<and> True \<and> (valid_objs and valid_cap a) s \<and> (valid_objs and valid_cap ab) s \<and> (valid_objs and valid_cap (cap.CNodeCap word n x)) s \<and> (valid_objs and valid_cap ab) s \<and> valid_objs s \<and> (valid_objs and valid_cap (cap.CNodeCap word n x)) s \<and> valid_idle s \<and> (valid_objs and valid_cap ab and valid_idle) s \<and> (valid_objs and valid_cap (cap.CNodeCap word n x) and valid_idle) s \<and> (valid_objs and (\<lambda>b. b \<turnstile> a) and valid_idle) s \<and> valid_etcbs s)) s
 2. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller] \<or> args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); gen_invocation_type label' \<notin> set [CNodeRevoke .e. CNodeSaveCaller]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 2. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = [] \<or> (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); args' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 2. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); (\<exists>x. args' = [x]) \<or> (\<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); \<exists>x. args' = [x]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps'))
 2. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); \<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap = transform_cap cap'; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (CNodeIntent ui); \<exists>index bits args'a. args' = index # bits # args'a \<and> gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller] \<and> (gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<notin> {CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([src_index], b) \<Rightarrow> True | (src_index # src_depth # args'', []) \<Rightarrow> True | (src_index # src_depth # args'', src_root_cap # exs') \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case (args'a, map fst excaps') of ([], b) \<Rightarrow> True | ([pivot_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data], b) \<Rightarrow> True | ([pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index], b) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', []) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', [pivot_root_cap]) \<Rightarrow> True | (pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'', pivot_root_cap # src_root_cap # exs') \<Rightarrow> False))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap cap' and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation cap slot excaps ui) (Decode_A.decode_cnode_invocation label' args' cap' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<noteq> CNodeRevoke \<and> gen_invocation_type label' \<noteq> CNodeDelete \<and> gen_invocation_type label' \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label' \<noteq> CNodeRotate \<and> gen_invocation_type label' \<noteq> CNodeSaveCaller \<and> (case args'a of [] \<Rightarrow> True | [src_index] \<Rightarrow> True | src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False) \<or> gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' \<noteq> CNodeRevoke \<and> gen_invocation_type label' \<noteq> CNodeDelete \<and> gen_invocation_type label' \<noteq> CNodeCancelBadgedSends \<and> gen_invocation_type label' \<noteq> CNodeRotate \<and> gen_invocation_type label' \<noteq> CNodeSaveCaller \<and> (case args'a of [] \<Rightarrow> True | [src_index] \<Rightarrow> True | src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case args'a of [] \<Rightarrow> True | [src_index] \<Rightarrow> True | src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (3 subgoals):
 1. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case args'a of [] \<Rightarrow> True | [src_index] \<Rightarrow> True | src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False; args'a = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits args'a a list. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case args'a of [] \<Rightarrow> True | [src_index] \<Rightarrow> True | src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False; args'a = a # list\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (3 subgoals):
 1. \<And>index bits. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') [index, bits] = Some (CNodeIntent ui); args' = [index, bits]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' [index, bits] (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits args'a a list. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case args'a of [] \<Rightarrow> True | [src_index] \<Rightarrow> True | src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False; args'a = a # list\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (3 subgoals):
 1. \<And>index bits. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') [index, bits] = Some (CNodeIntent ui); args' = [index, bits]; gen_invocation_type label' = CNodeCopy \<or> gen_invocation_type label' = CNodeMint \<or> gen_invocation_type label' = CNodeMove \<or> gen_invocation_type label' = CNodeMutate; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' [index, bits] (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits args'a a list. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case args'a of [] \<Rightarrow> True | [src_index] \<Rightarrow> True | src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False; args'a = a # list\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits args'a a list. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case args'a of [] \<Rightarrow> True | [src_index] \<Rightarrow> True | src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False; args'a = a # list\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits a list. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # a # list) = Some (CNodeIntent ui); args' = index # bits # a # list; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case list of [] \<Rightarrow> True | src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # a # list) (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (3 subgoals):
 1. \<And>index bits a list. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # a # list) = Some (CNodeIntent ui); args' = index # bits # a # list; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case list of [] \<Rightarrow> True | src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False; list = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # a # list) (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits a list aa lista. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # a # list) = Some (CNodeIntent ui); args' = index # bits # a # list; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case list of [] \<Rightarrow> True | src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False; list = aa # lista\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # a # list) (cap.CNodeCap word n x) (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (3 subgoals):
 1. \<And>index bits a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') [index, bits, a] = Some (CNodeIntent ui); args' = [index, bits, a]; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' [index, bits, a] (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits a list aa lista. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # a # list) = Some (CNodeIntent ui); args' = index # bits # a # list; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case list of [] \<Rightarrow> True | src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False; list = aa # lista\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # a # list) (cap.CNodeCap word n x) (map fst excaps'))
 3. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits a list aa lista. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # a # list) = Some (CNodeIntent ui); args' = index # bits # a # list; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case list of [] \<Rightarrow> True | src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False; list = aa # lista\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # a # list) (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits a aa lista. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # a # aa # lista) = Some (CNodeIntent ui); args' = index # bits # a # aa # lista; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; case map fst excaps' of [] \<Rightarrow> True | src_root_cap # exs' \<Rightarrow> False\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # a # aa # lista) (cap.CNodeCap word n x) (map fst excaps'))
 2. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits a aa lista. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list []; transform_intent (invocation_type label') (index # bits # a # aa # lista) = Some (CNodeIntent ui); args' = index # bits # a # aa # lista; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; excaps' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list []) ui) (Decode_A.decode_cnode_invocation label' (index # bits # a # aa # lista) (cap.CNodeCap word n x) [])
 2. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits a aa lista. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list []; transform_intent (invocation_type label') (index # bits # a # aa # lista) = Some (CNodeIntent ui); args' = index # bits # a # aa # lista; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<in> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' \<noteq> CNodeRevoke; gen_invocation_type label' \<noteq> CNodeDelete; gen_invocation_type label' \<noteq> CNodeCancelBadgedSends; gen_invocation_type label' \<noteq> CNodeRotate; gen_invocation_type label' \<noteq> CNodeSaveCaller; excaps' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list []) ui) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
throwError TruncatedMessage
odE)
 2. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits a aa lista. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list []; transform_intent (invocation_type label') (index # bits # a # aa # lista) = Some (CNodeIntent ui); args' = index # bits # a # aa # lista; invocation_type label' = GenInvocationLabel CNodeCopy \<or> invocation_type label' = GenInvocationLabel CNodeMint \<or> invocation_type label' = GenInvocationLabel CNodeMove \<or> invocation_type label' = GenInvocationLabel CNodeMutate; invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke; invocation_type label' \<noteq> GenInvocationLabel CNodeDelete; invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends; invocation_type label' \<noteq> GenInvocationLabel CNodeRotate; invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller; excaps' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list []) ui) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
throwError TruncatedMessage
odE)
 2. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits a aa lista. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = []; transform_intent (invocation_type label') (index # bits # a # aa # lista) = Some (CNodeIntent ui); args' = index # bits # a # aa # lista; invocation_type label' = GenInvocationLabel CNodeCopy \<or> invocation_type label' = GenInvocationLabel CNodeMint \<or> invocation_type label' = GenInvocationLabel CNodeMove \<or> invocation_type label' = GenInvocationLabel CNodeMutate; invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke; invocation_type label' \<noteq> GenInvocationLabel CNodeDelete; invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends; invocation_type label' \<noteq> GenInvocationLabel CNodeRotate; invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller; excaps' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_etcbs) throw (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
throwError TruncatedMessage
odE)
 2. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<And>index bits args'a. \<lbrakk>cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') (index # bits # args'a) = Some (CNodeIntent ui); args' = index # bits # args'a; gen_invocation_type label' \<in> set [CNodeRevoke .e. CNodeSaveCaller]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate] \<and> gen_invocation_type label' = CNodeRotate \<and> (case args'a of [] \<Rightarrow> True | [pivot_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data] \<Rightarrow> True | [pivot_new_data, pivot_index, pivot_depth, src_new_data, src_index] \<Rightarrow> True | pivot_new_data # pivot_index # pivot_depth # src_new_data # src_index # src_depth # args'' \<Rightarrow> case map fst excaps' of [] \<Rightarrow> True | [pivot_root_cap] \<Rightarrow> True | pivot_root_cap # src_root_cap # exs' \<Rightarrow> False)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list excaps') ui) (Decode_A.decode_cnode_invocation label' (index # bits # args'a) (cap.CNodeCap word n x) (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<And>index bits x21 x21a x21b x21c x21d x21e x22e. \<lbrakk>args' = index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list []; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; invocation_type label' = GenInvocationLabel CNodeRotate; excaps' = []; ui = CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list []) (CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c)) (Decode_A.decode_cnode_invocation label' (index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e) (cap.CNodeCap word n x) [])
 2. \<And>index bits x21 x21a x21b x21c x21d x21e x22e a aa b. \<lbrakk>args' = index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list [(a, aa, b)]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; invocation_type label' = GenInvocationLabel CNodeRotate; ui = CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c; excaps' = [(a, aa, b)]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_cap a and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list [(a, aa, b)]) (CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c)) (Decode_A.decode_cnode_invocation label' (index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e) (cap.CNodeCap word n x) [a]) proof (prove)
goal (2 subgoals):
 1. \<And>index bits x21 x21a x21b x21c x21d x21e x22e. \<lbrakk>args' = index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = []; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; invocation_type label' = GenInvocationLabel CNodeRotate; excaps' = []; ui = CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_etcbs) throw (Decode_A.decode_cnode_invocation label' (index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e) (cap.CNodeCap word n x) [])
 2. \<And>index bits x21 x21a x21b x21c x21d x21e x22e a aa b. \<lbrakk>args' = index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list [(a, aa, b)]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; invocation_type label' = GenInvocationLabel CNodeRotate; ui = CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c; excaps' = [(a, aa, b)]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_cap a and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list [(a, aa, b)]) (CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c)) (Decode_A.decode_cnode_invocation label' (index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e) (cap.CNodeCap word n x) [a]) proof (prove)
goal (2 subgoals):
 1. \<And>index bits x21 x21a x21b x21c x21d x21e x22e. \<lbrakk>args' = index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = []; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' = CNodeRotate; excaps' = []; ui = CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_etcbs) throw (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
throwError TruncatedMessage
odE)
 2. \<And>index bits x21 x21a x21b x21c x21d x21e x22e a aa b. \<lbrakk>args' = index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list [(a, aa, b)]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; invocation_type label' = GenInvocationLabel CNodeRotate; ui = CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c; excaps' = [(a, aa, b)]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_cap a and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list [(a, aa, b)]) (CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c)) (Decode_A.decode_cnode_invocation label' (index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e) (cap.CNodeCap word n x) [a]) proof (prove)
goal (1 subgoal):
 1. \<And>index bits x21 x21a x21b x21c x21d x21e x22e a aa b. \<lbrakk>args' = index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = transform_cap_list [(a, aa, b)]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; invocation_type label' = GenInvocationLabel CNodeRotate; ui = CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c; excaps' = [(a, aa, b)]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_cap a and valid_etcbs) (CNode_D.decode_cnode_invocation (cdl_cap.CNodeCap word (of_bl x) (length x) n) (transform_cslot_ptr slot') (transform_cap_list [(a, aa, b)]) (CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c)) (Decode_A.decode_cnode_invocation label' (index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e) (cap.CNodeCap word n x) [a]) proof (prove)
goal (1 subgoal):
 1. \<And>index bits x21 x21a x21b x21c x21d x21e x22e a aa b. \<lbrakk>args' = index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = [(transform_cap a, transform_cslot_ptr (aa, b))]; gen_invocation_type label' \<notin> set [CNodeCopy .e. CNodeMutate]; invocation_type label' = GenInvocationLabel CNodeRotate; ui = CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c; excaps' = [(a, aa, b)]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_cap a and valid_etcbs) throw (Decode_A.decode_cnode_invocation label' (index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e) (cap.CNodeCap word n x) [a]) proof (prove)
goal (1 subgoal):
 1. \<And>index bits x21 x21a x21b x21c x21d x21e x22e a aa b. \<lbrakk>args' = index # bits # x21 # x21a # x21b # x21c # x21d # x21e # x22e; CNodeRotate \<in> set [CNodeRevoke .e. CNodeSaveCaller]; cap = cdl_cap.CNodeCap word (of_bl x) (length x) n; cap' = cap.CNodeCap word n x; slot = transform_cslot_ptr slot'; excaps = [(transform_cap a, transform_cslot_ptr (aa, b))]; CNodeRotate \<notin> set [CNodeCopy .e. CNodeMutate]; gen_invocation_type label' = CNodeRotate; ui = CNodeRotateIntent index bits x21a x21b x21 x21d x21e x21c; excaps' = [(a, aa, b)]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_cnode_invocation y)) (\<lambda>_. True) (invs and valid_cap (cap.CNodeCap word n x) and valid_cap a and valid_etcbs) throw (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (cap.CNodeCap word n x) (to_bl index) (unat bits);
throwError TruncatedMessage
odE) proof (prove)
goal:
No subgoals!